使用配置文件 (.ebextensions) 在自定义 VPC 中为 TCP 直通配置 Elastic Beanstalk 环境的负载均衡器

Question

我已尝试遵循此特定文档

http://docs.aws.amazon.com/elasticbeanstalk/latest/dg/https-tcp-passthrough.html

没有满足我的特殊需求。所需要的是从我们的代理服务器通过 ELB 的第 4 层 TCP 直通，直到 Tomcat 后端才终止 SSL。入口端口为 TCP 443，出口端口为 8443。还需要使用自定义 VPC 而不是默认 VPC。如何利用配置文件完成此操作？

Answer 1

我能够使用以下配置文件解决问题：

https-实例-balancer.config

    {
        "Resources": {
            "AWSEBSecurityGroup": {
                "Type": "AWS::EC2::SecurityGroup",
                "Properties": {
                    "VpcId": "vpc-xxxxxxxx",
                    "GroupDescription": "EC28443Ingress",
                    "SecurityGroupIngress": [
                        {
                            "IpProtocol": "tcp",
                            "FromPort": 8443,
                            "ToPort": 8443,
                            "CidrIp": "0.0.0.0/0"
                        }
                    ]
                }
            },
            "AWSEBLoadBalancerSecurityGroup": {
                "Type": "AWS::EC2::SecurityGroup",
                "Properties": {
                    "VpcId": "vpc-xxxxxxxx",
                    "GroupDescription": "ELB443and8443Ingress",
                    "SecurityGroupIngress": [
                        {
                            "IpProtocol": "tcp",
                            "FromPort": 443,
                            "ToPort": 443,
                            "CidrIp": "0.0.0.0/0"
                        }
                    ],
                    "SecurityGroupEgress": [
                        {
                            "IpProtocol": "tcp",
                            "FromPort": 8443,
                            "ToPort": 8443,
                            "CidrIp": "0.0.0.0/0"
                        }
                    ]
                }
            },
            "AWSEBLoadBalancer": {
                "Type": "AWS::ElasticLoadBalancing::LoadBalancer",
                "Properties": {
                    "Listeners": [
                        {
                            "LoadBalancerPort": 443,
                            "Protocol": "TCP",
                            "InstancePort": 8443,
                            "InstanceProtocol": "TCP"
                        }
                    ],
                    "SecurityGroups": [
                        {
                            "Fn::GetAtt": [
                                "AWSEBLoadBalancerSecurityGroup",
                                "GroupId"
                            ]
                        }
                    ]
                }
            }
        }
    }

https-lb-passthrough.config

    {
      "option_settings": {
        "aws:elb:listener:443": {
          "ListenerProtocol": "TCP",
          "InstancePort": 8443,
          "InstanceProtocol": "TCP"
        },
        "aws:elb:healthcheck": {
          "Target": "TCP:8443"
        }
      }
    }

使用 Terraform 等软件可能更容易完成此操作，但对某些人来说可能不是一个选择。