使用堡垒主机设置 Aurora 时，安全组和子网属于不同的网络错误

Question

我正在尝试使用关联的 Bastion 主机设置 RDS Aurora 集群以进行访问。我收到以下错误

Security group sg-0e71d565ec5decfd9 and subnet subnet-c2cda1aa belong to different networks. 
(Service: AmazonEC2; Status Code: 400; Error Code: InvalidParameter; 
Request ID: 68495593-198a-416a-84b5-f35439f040c3)

我对导致此问题的原因感到非常困惑，因为我明确指定了此脚本的 VPC id。 我路过

VpcId: vpc-0e613d6fe837e387f
VpcSecurityGroupId: sg-03d5dd202625be5c5

我对原因的最佳猜测是堡垒安全组默认使用特定网络，但我似乎无法弄清楚如何解决这个问题。

我的cloudformation脚本如下

Description: Set up a serverles PostgreSQL cluster with a bastion host (using Aurora)

Parameters: 
    DatabaseName:
            Type: String
    EngineVersion:
            Type: String
            Default: 11.4
    MasterUsername:
            Type: String
            Default: root
    MasterUserPassword:
            Type: String
            Default: root1234
            NoEcho: true
    VpcId:
            Type: AWS::EC2::VPC::Id
    VpcSecurityGroupId:
            Type: AWS::EC2::SecurityGroup::Id
    DBSubnetGroupName:
            Type: String
    BastionImageId:
            Type: AWS::SSM::Parameter::Value<AWS::EC2::Image::Id>
            Default: /aws/service/ami-amazon-linux-latest/amzn-ami-hvm-x86_64-ebs
    BastionKeyName:
            Type: AWS::EC2::KeyPair::KeyName
            Description: EC2 key used to connect to the bastion host
    DeletionProtection:
            Type: String
            Default: false
            AllowedValues:
            - true
            - false

Resources:
    Cluster:
            Type: AWS::RDS::DBCluster
            Properties:
                    Engine: aurora-postgresql
                    EngineVersion: !Ref EngineVersion
                    DatabaseName: !Ref DatabaseName
                    MasterUsername: !Ref MasterUsername
                    MasterUserPassword: !Ref MasterUserPassword
                    DBClusterIdentifier: !Ref AWS::StackName
                    DBClusterParameterGroupName: !Ref DBParameterGroup
                    DBSubnetGroupName: !Ref DBSubnetGroupName
                    BackupRetentionPeriod: 35
                    DeletionProtection: !Ref DeletionProtection
                    VpcSecurityGroupIds:
                    - !Ref VpcSecurityGroupId
    DBParameterGroup:                                                                                                     
            Type: AWS::RDS::DBClusterParameterGroup
            Properties:
                    Description: The parameter group for the discourse DB cluster
                    Family: aurora-postgresql11
                    Parameters:
                            client_encoding: 'UTF8' 
    BastionSecurityGroup:
            Type: AWS::EC2::SecurityGroup
            Properties:
                    GroupDescription: !Sub Bastion for ${AWS::StackName}
                    SecurityGroupEgress:
                    - CidrIp: 0.0.0.0/0
                      FromPort: -1
                      ToPort: -1
                      IpProtocol: -1
                    - DestinationSecurityGroupId: !Ref VpcSecurityGroupId
                      IpProtocol: tcp
                      FromPort: 3306
                      ToPort: 3306
                    SecurityGroupIngress: []
                    VpcId: !Ref VpcId
    Bastion: 
            Type: AWS::EC2::Instance
            Properties: 
                    DisableApiTermination: true
                    ImageId: !Ref BastionImageId
                    InstanceType: t2.nano
                    KeyName: !Ref BastionKeyName
                    Monitoring: false
                    SecurityGroupIds:
                    - !Ref VpcSecurityGroupId
                    - !Ref BastionSecurityGroup
                    UserData: !Base64 'yum install postgresql --assumeyes' # if this script does not work this line  broke it 

Outputs:
    Host: 
            Value: !GetAtt Cluster.Endpoint.Address
            Export:
                    Name: !Sub ${AWS::StackName}Host
    Name:
            Value: !Ref DatabaseName
            Export:
                    Name: !Sub ${AWS::StackName}Name
    BastionHost:
            Value: !GetAtt Bastion.PublicDnsName
            Export:
                    Name: !Sub ${AWS::StackName}BastionHost
    BastionIp:
            Value: !GetAtt Bastion.PublicIp
            Export:
                    Name: !Sub ${AWS::StackName}BastionIp
    BastionSecurityGroupId:
            Value: !GetAtt BastionSecurityGroup.GroupId
            Export:
                    Name: !Sub ${AWS::StackName}BastionSecurityGroupId

Answer 1

这个错误看起来很容易解释。您可能会显式传递 VPC ID，但您也会显式传递 VPC 安全组 ID 和子网组名称。从您的错误来看，您似乎分别传递了sg-0e71d565ec5decfd9 和subnet-c2cda1aa，但显然安全组和子网组中的子网不是同一个 VPC 的一部分。请在您的设置中进行交叉检查。