当前位置： 首页 > article >正文

aws(学习笔记第十六课) 使用负载均衡器(ELB)解耦webserver以及输出ELB的日志到S3

article 2025/1/18 18:53:55

aws(学习笔记第十六课)

  • 使用负载均衡器(ELB)以及输出ELB的日志到S3

学习内容：

  • 使用负载均衡器(ELB)解耦web server
  • 输出ELB的日志到S3

1. 使用负载均衡器(ELB)

  1. 全体架构
    使用ELB(Elastic Load Balancer)能够解耦外部internet访问和web server之间的耦合，让外部internet访问只能认识ELB，只知道是ELB为它服务，但是具体的web server对于外部来说却是不意识的。

在这里插入图片描述
2. 代码解析

  • 全体代码
    {
	"AWSTemplateFormatVersion": "2010-09-09",
	"Description": "AWS in Action: chapter 12 (Load Balancer)",
	"Parameters": {
		"KeyName": {
			"Description": "Key Pair name",
			"Type": "AWS::EC2::KeyPair::KeyName",
			"Default": "my-cli-key"
		},
		"NumberOfServers": {
			"Description": "Number of servers",
			"Type": "Number",
			"Default": "2",
			"MinValue": "2",
			"MaxValue": "4"
		}
	},
	"Mappings": {
		"EC2RegionMap": {
			"ap-northeast-1": {"AmazonLinuxAMIHVMEBSBacked64bit": "ami-cbf90ecb"},
			"ap-southeast-1": {"AmazonLinuxAMIHVMEBSBacked64bit": "ami-68d8e93a"},
			"ap-southeast-2": {"AmazonLinuxAMIHVMEBSBacked64bit": "ami-fd9cecc7"},
			"eu-central-1": {"AmazonLinuxAMIHVMEBSBacked64bit": "ami-a8221fb5"},
			"eu-west-1": {"AmazonLinuxAMIHVMEBSBacked64bit": "ami-a10897d6"},
			"sa-east-1": {"AmazonLinuxAMIHVMEBSBacked64bit": "ami-b52890a8"},
			"us-east-1": {"AmazonLinuxAMIHVMEBSBacked64bit": "ami-1ecae776"},
			"us-west-1": {"AmazonLinuxAMIHVMEBSBacked64bit": "ami-d114f295"},
			"us-west-2": {"AmazonLinuxAMIHVMEBSBacked64bit": "ami-e7527ed7"}
		}
	},
	"Resources": {
		"VPC": {
			"Type": "AWS::EC2::VPC",
			"Properties": {
				"CidrBlock": "172.31.0.0/16",
				"EnableDnsHostnames": "true"
			}
		},
		"InternetGateway": {
			"Type": "AWS::EC2::InternetGateway",
			"Properties": {
			}
		},
		"VPCGatewayAttachment": {
			"Type": "AWS::EC2::VPCGatewayAttachment",
			"Properties": {
				"VpcId": {"Ref": "VPC"},
				"InternetGatewayId": {"Ref": "InternetGateway"}
			}
		},
		"Subnet": {
			"Type": "AWS::EC2::Subnet",
			"Properties": {
				"AvailabilityZone": {"Fn::Select": ["0", {"Fn::GetAZs": ""}]},
				"CidrBlock": "172.31.38.0/24",
				"VpcId": {"Ref": "VPC"}
			}
		},
		"RouteTable": {
			"Type": "AWS::EC2::RouteTable",
			"Properties": {
				"VpcId": {"Ref": "VPC"}
			}
		},
		"RouteTableAssociation": {
			"Type": "AWS::EC2::SubnetRouteTableAssociation",
			"Properties": {
				"SubnetId": {"Ref": "Subnet"},
				"RouteTableId": {"Ref": "RouteTable"}
			}
		},
		"RoutePublicNATToInternet": {
			"Type": "AWS::EC2::Route",
			"Properties": {
				"RouteTableId": {"Ref": "RouteTable"},
				"DestinationCidrBlock": "0.0.0.0/0",
				"GatewayId": {"Ref": "InternetGateway"}
			},
			"DependsOn": "VPCGatewayAttachment"
		},
		"NetworkAcl": {
			"Type": "AWS::EC2::NetworkAcl",
			"Properties": {
				"VpcId": {"Ref": "VPC"}
			}
		},
		"SubnetNetworkAclAssociation": {
			"Type": "AWS::EC2::SubnetNetworkAclAssociation",
			"Properties": {
				"SubnetId": {"Ref": "Subnet"},
				"NetworkAclId": {"Ref": "NetworkAcl"}
			}
		},
		"NetworkAclEntryIngress": {
			"Type": "AWS::EC2::NetworkAclEntry",
			"Properties": {
				"NetworkAclId": {"Ref": "NetworkAcl"},
				"RuleNumber": "100",
				"Protocol": "-1",
				"RuleAction": "allow",
				"Egress": "false",
				"CidrBlock": "0.0.0.0/0"
			}
		},
		"NetworkAclEntryEgress": {
			"Type": "AWS::EC2::NetworkAclEntry",
			"Properties": {
				"NetworkAclId": {"Ref": "NetworkAcl"},
				"RuleNumber": "100",
				"Protocol": "-1",
				"RuleAction": "allow",
				"Egress": "true",
				"CidrBlock": "0.0.0.0/0"
			}
		},
		"LoadBalancerSecurityGroup": {
			"Type": "AWS::EC2::SecurityGroup",
			"Properties": {
				"GroupDescription": "elb-sg",
				"VpcId": {"Ref": "VPC"},
				"SecurityGroupIngress": [{
					"CidrIp": "0.0.0.0/0",
					"FromPort": 80,
					"IpProtocol": "tcp",
					"ToPort": 80
				}]
			}
		},
		"LoadBalancer": {
			"Type": "AWS::ElasticLoadBalancing::LoadBalancer",
			"Properties": {
				"Subnets": [{"Ref": "Subnet"}],
				"LoadBalancerName": "elb",
				"Listeners": [{
					"InstancePort": "80",
					"InstanceProtocol": "HTTP",
					"LoadBalancerPort": "80",
					"Protocol": "HTTP"
				}],
				"HealthCheck": {
					"HealthyThreshold": "3",
					"Interval": "10",
					"Target": "HTTP:80/index.html",
					"Timeout": "5",
					"UnhealthyThreshold": "2"
				},
				"SecurityGroups": [{"Ref": "LoadBalancerSecurityGroup"}],
				"Scheme": "internet-facing"
			},
			"DependsOn": "VPCGatewayAttachment"
		},
		"WebServerSecurityGroup": {
			"Type": "AWS::EC2::SecurityGroup",
			"Properties": {
				"GroupDescription": "awsinaction-sg",
				"VpcId": {"Ref": "VPC"},
				"SecurityGroupIngress": [{
					"CidrIp": "0.0.0.0/0",
					"FromPort": 22,
					"IpProtocol": "tcp",
					"ToPort": 22
				}, {
					"FromPort": 80,
					"IpProtocol": "tcp",
					"SourceSecurityGroupId": {"Ref": "LoadBalancerSecurityGroup"},
					"ToPort": 80
				}]
			}
		},
		"LaunchTemplate": {
			"Type": "AWS::EC2::LaunchTemplate",
			"Metadata": {
				"AWS::CloudFormation::Init": {
					"config": {
						"packages": {
							"yum": {
								"httpd": []
							}
						},
						"files": {
							"/tmp/config": {
								"content": {"Fn::Join": ["", [
									"#!/bin/bash -ex\n",
									"PRIVATE_IP=`curl -s http://169.254.169.254/latest/meta-data/local-ipv4`\n",
									"echo \"<html><head><title>$PRIVATE_IP</title></head><body><h1>$PRIVATE_IP</h1></body></html>\" > index.html\n"
								]]},
								"mode": "000500",
								"owner": "root",
								"group": "root"
							}
						},
						"commands": {
							"01_config": {
								"command": "/tmp/config",
								"cwd": "/var/www/html"
							}
						},
						"services": {
							"sysvinit": {
								"httpd": {
									"enabled": "true",
									"ensureRunning": "true"
								}
							}
						}
					}
				}
			},
			"Properties": {
				"LaunchTemplateData":{
					"EbsOptimized": false,
					"ImageId": {"Fn::FindInMap": ["EC2RegionMap", {"Ref": "AWS::Region"}, "AmazonLinuxAMIHVMEBSBacked64bit"]},
					"InstanceType": "t2.micro",
					"NetworkInterfaces":[
						{
							"DeviceIndex":0,
							"AssociatePublicIpAddress":true,
							"Groups":[
								{"Ref": "WebServerSecurityGroup"}
							],
							"DeleteOnTermination":true
						}
					],
					"KeyName": {"Ref": "KeyName"},
					"UserData": {"Fn::Base64": {"Fn::Join": ["", [
						"#!/bin/bash -ex\n",
						"yum update -y aws-cfn-bootstrap\n",
						"/opt/aws/bin/cfn-init -v --stack ", {"Ref": "AWS::StackName"}, " --resource LaunchTemplate --region ", {"Ref": "AWS::Region"}, "\n",
						"/opt/aws/bin/cfn-signal -e $? --stack ", {"Ref": "AWS::StackName"}, " --resource AutoScalingGroup --region ", {"Ref": "AWS::Region"}, "\n"
					]]}}
				}
			}
		},
		"AutoScalingGroup": {
			"Type": "AWS::AutoScaling::AutoScalingGroup",
			"Properties": {
				"LoadBalancerNames": [{"Ref": "LoadBalancer"}],
				"LaunchTemplate" : {"LaunchTemplateId" : {"Ref" : "LaunchTemplate"},"Version" : {"Fn::GetAtt" : ["LaunchTemplate","LatestVersionNumber"]}},
				"MinSize": {"Ref": "NumberOfServers"},
				"MaxSize": {"Ref": "NumberOfServers"},
				"DesiredCapacity": {"Ref": "NumberOfServers"},
				"VPCZoneIdentifier": [{"Ref": "Subnet"}]
			},
			"CreationPolicy": {
				"ResourceSignal": {
					"Timeout": "PT10M"
				}
			},
			"DependsOn": "VPCGatewayAttachment"
		}
	},
	"Outputs": {
		"URL": {
			"Value": {"Fn::Join": ["", ["http://", {"Fn::GetAtt": ["LoadBalancer", "DNSName"]}]]},
			"Description": "Load Balancer URL"
		}
	}
}
  • 主要代码分析
    • WebServerSecurityGroup中的SourceSecurityGroupId
      这里，WebServerSecurityGroup的SourceSecurityGroupId为LoadBalancerSecurityGroup，表明只有LoadBalancerSecurityGroup所在的主机，也就是LoadBalancer才能对web server访问80端口。
      "WebServerSecurityGroup": {
			"Type": "AWS::EC2::SecurityGroup",
			"Properties": {
				"GroupDescription": "awsinaction-sg",
				"VpcId": {"Ref": "VPC"},
				"SecurityGroupIngress": [{
					"CidrIp": "0.0.0.0/0",
					"FromPort": 22,
					"IpProtocol": "tcp",
					"ToPort": 22
				}, {
					"FromPort": 80,
					"IpProtocol": "tcp",
					"SourceSecurityGroupId": {"Ref": "LoadBalancerSecurityGroup"},
					"ToPort": 80
				}]
			}
		},
    • LoadBalancer加入HealthCheck
      这里，LoadBalancer里面，加入了对web server的HealthCheck，当web server的index.hmlt在80端口能够访问之后，才能够开始转送到web server
      		"LoadBalancer": {
			"Type": "AWS::ElasticLoadBalancing::LoadBalancer",
			"Properties": {
				"Subnets": [{"Ref": "Subnet"}],
				"LoadBalancerName": "elb",
				"Listeners": [{
					"InstancePort": "80",
					"InstanceProtocol": "HTTP",
					"LoadBalancerPort": "80",
					"Protocol": "HTTP"
				}],
				"HealthCheck": {
					"HealthyThreshold": "3",
					"Interval": "10",
					"Target": "HTTP:80/index.html",
					"Timeout": "5",
					"UnhealthyThreshold": "2"
				},
				"SecurityGroups": [{"Ref": "LoadBalancerSecurityGroup"}],
				"Scheme": "internet-facing"
			},
			"DependsOn": "VPCGatewayAttachment"
		},

2. 输出ELB的日志到S3

  • 首先设置S3 存储桶策略，允许ELB写入log到S3
    • policy.json策略文件
      事先作成elb-log-20241208的S3 bucket，之后写出policy文件允许logdelivery.elasticloadbalancing.amazonaws.com这个service能够putObject给S3 bucket。
      {
  "Id": "Policy1429136655940",
  "Version": "2012-10-17",
  "Statement": [{
    "Sid": "Stmt1429136633762",
    "Action": ["s3:PutObject"],
    "Effect": "Allow",
    "Resource": "arn:aws:s3:::elb-log-20241208/*",
    "Principal": {
      "AWS": [
        "127311923021", "027434742980", "797873946194",
        "156460612806", "054676820928", "582318560864",
        "114774131450", "783225319266", "507241528517"
      ]
    }
  }]
}
      这里，127311923021，027434742980像是一些magic code，这到底是什么呢？可以参照enable-access-logging.html，它们是所在地区的 Elastic Load Balancing 的 ID： AWS 账户。
    • 设置policy.json策略文件给S3的bucket
      aws s3api put-bucket-policy --bucket elb-log-20241208 --policy file://policy/elb-log-policy.json
      在这里插入图片描述
    • 配置cloudformation让ELB输入log到S3 bucket
      AccessLoggingPolicy这里就是设置描述log输出的设置。
      		"LoadBalancer": {
			"Type": "AWS::ElasticLoadBalancing::LoadBalancer",
			"Properties": {
				"Subnets": [{"Ref": "Subnet"}],
				"LoadBalancerName": "elb",
				"Listeners": [{
					"InstancePort": "80",
					"InstanceProtocol": "HTTP",
					"LoadBalancerPort": "80",
					"Protocol": "HTTP"
				}],
				"HealthCheck": {
					"HealthyThreshold": "3",
					"Interval": "10",
					"Target": "HTTP:80/index.html",
					"Timeout": "5",
					"UnhealthyThreshold": "2"
				},
				"AccessLoggingPolicy":{
					"ENabled": true,
					"S3BucketName":"elb-log-20241208",
					"S3BucketPrefix":"my-application/production"
				}
				"SecurityGroups": [{"Ref": "LoadBalancerSecurityGroup"}],
				"Scheme": "internet-facing"
			},
			"DependsOn": "VPCGatewayAttachment"
		},
      在这里插入图片描述
      在这里插入图片描述
    • 重新访问ELB
      在这里插入图片描述
    • 检查S3的log文件夹
      可以看到log已经开始写入到S3
      在这里插入图片描述

http://www.kler.cn/a/429207.html

相关文章：

  • 从零开始,掌握Django Web开发
  • 浅谈云计算21 | Docker容器技术
  • minio https配置
  • web开发工具之：三、JWT的理论知识，java的支持，封装的工具类可以直接使用
  • 【Idea启动项目报错NegativeArraySizeException】
  • 2019-Android-高级面试题总结-从java语言到AIDL使用与原理
  • 解决：IDEA中@Autowired自动注入MyBatis Mapper报红警告的几种解决方法
  • SQL注入--二次注入
  • Mybatis-plus 简单使用，mybatis-plus 分页模糊查询报500 的错
  • 设计模式的艺术读书笔记
  • 前端热门面试题目（六）
  • Elasticsearch使用（2）：docker安装es、基础操作、mapping映射
  • MTK关于 Camera Otp
  • 快速了解什么是WELL认证？
  • Kotlin设计模式之抽象工厂模式
  • Linux C/C++如何处理两个静态库相互依赖的问题
  • Vulkan 开发（十二）：Vulkan 渲染通道
  • 3D 生成重建026-Wonder3D单视图3d生成
  • 2024.12.6——攻防世界PHP2
  • 2024年11月中国及周边部分亚洲国家干旱情况的监测报告
  • Linux下redis环境的搭建
  • pushgateway HA高可用方案
  • YOLOv8实战道路裂缝缺陷识别
  • 唯一索引、普通索引的使用场景
  • “Flash闪存”基础 介绍及 雷龙电子“CSNP32GCR01-AOW”产品的测试
  • 【Linux】基础IO-----文件详解