ошибка удаления шаблона CloudFormation вместо создания новых элементов

Question

Я новичок в AWS Cloud Formation, хорошо, я повторно использую 2 шаблона, первый работает совершенно нормально, он создает сетевой стек для AWS Fargate, см. Шаблон № 1 ниже, но второй ( который не работает) должен создать службы, вместо этого он пытается удалить большинство элементов сетевого стека, см. шаблон № 2 ниже.

Я вижу в «Предварительном просмотре изменений», как это отметка «удалить» почти все, что я создал ранее с помощью шаблона сетевого стека, см. изображение ниже # 3.

Кто-нибудь может посоветовать, что не так со вторым шаблоном?, спасибо.

1) Сетевой стек

AWSTemplateFormatVersion: '2010-09-09'
Description: Create a network stack with a public vpc, fargate cluster and load balancer as a parent stack. 

Mappings: 
  SubnetConfig:
    VPC:
      CIDR: '10.0.0.0/16'
    PublicOne:
      CIDR: '10.0.0.0/24'
    PublicTwo:
      CIDR: '10.0.1.0/24'  

Resources: 
  FargateVpc:
    Type: AWS::EC2::VPC
    Properties:
      EnableDnsSupport: true
      EnableDnsHostnames: true
      CidrBlock: !FindInMap ['SubnetConfig', 'VPC', 'CIDR']      

  PublicSubnetOne:
    Type: AWS::EC2::Subnet
    Properties:
      AvailabilityZone: 
        Fn::Select:
        - 0
        - Fn::GetAZs: {Ref: 'AWS::Region'}   
      VpcId: !Ref FargateVpc      
      CidrBlock: !FindInMap ['SubnetConfig', 'PublicOne', 'CIDR']
      MapPublicIpOnLaunch: true

  PublicSubnetTwo:
    Type: AWS::EC2::Subnet
    Properties:
      AvailabilityZone: 
        Fn::Select:
        - 1
        - Fn::GetAZs: {Ref: 'AWS::Region'}   
      VpcId: !Ref FargateVpc      
      CidrBlock: !FindInMap ['SubnetConfig', 'PublicTwo', 'CIDR']
      MapPublicIpOnLaunch: true      

  InternetGateway:
    Type: AWS::EC2::InternetGateway 

  GatewayAttachment:
    Type: AWS::EC2::VPCGatewayAttachment 
    Properties:
      VpcId: !Ref FargateVpc
      InternetGatewayId: !Ref InternetGateway

  PublicRouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref FargateVpc 

  PublicRoute:
    Type: AWS::EC2::Route 
    Properties:
      RouteTableId: !Ref PublicRouteTable
      DestinationCidrBlock: '0.0.0.0/0' 
      GatewayId: !Ref InternetGateway  

  PublicSubnetOneRouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation 
    Properties:
      SubnetId: !Ref PublicSubnetOne
      RouteTableId: !Ref PublicRouteTable    

  PublicSubnetTwoRouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation 
    Properties:
      SubnetId: !Ref PublicSubnetTwo
      RouteTableId: !Ref PublicRouteTable          

# ECS Cluster
  ECSCluster:
    Type: AWS::ECS::Cluster

# ECS Roles

# ECS Roles    
# This role is used by the ECS tasks themselves.
  ECSTaskExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
        - Effect: Allow
          Principal:
            Service: [ecs-tasks.amazonaws.com]
          Action: ['sts:AssumeRole']
      Path: /
      Policies:
        - PolicyName: AmazonECSTaskExecutionRolePolicy
          PolicyDocument:
            Statement:
            - Effect: Allow
              Action:
                # Allow the ECS Tasks to download images from ECR
                - 'ecr:GetAuthorizationToken'
                - 'ecr:BatchCheckLayerAvailability'
                - 'ecr:GetDownloadUrlForLayer'
                - 'ecr:BatchGetImage'

                # Allow the ECS tasks to upload logs to CloudWatch
                - 'logs:CreateLogStream'
                - 'logs:PutLogEvents'
              Resource: '*'    

  # This is an IAM role which authorizes ECS to manage resources on our
  # account on our behalf, such as updating our load balancer with the
  # details of where our containers are, so that traffic can reach your
  # containers.
  ECSRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
        - Effect: Allow
          Principal:
            Service: [ecs.amazonaws.com]
          Action: ['sts:AssumeRole']
      Path: /
      Policies:
      - PolicyName: ecs-service
        PolicyDocument:
          Statement:
          - Effect: Allow
            Action:
              # Rules which allow ECS to attach network interfaces to instances
              # on our behalf in order for awsvpc networking mode to work right
              - 'ec2:AttachNetworkInterface'
              - 'ec2:CreateNetworkInterface'
              - 'ec2:CreateNetworkInterfacePermission'
              - 'ec2:DeleteNetworkInterface'
              - 'ec2:DeleteNetworkInterfacePermission'
              - 'ec2:Describe*'
              - 'ec2:DetachNetworkInterface'

              # Rules which allow ECS to update load balancers on our behalf
              # with the information about how to send traffic to our containers
              - 'elasticloadbalancing:DeregisterInstancesFromLoadBalancer'
              - 'elasticloadbalancing:DeregisterTargets'
              - 'elasticloadbalancing:Describe*'
              - 'elasticloadbalancing:RegisterInstancesWithLoadBalancer'
              - 'elasticloadbalancing:RegisterTargets'
            Resource: '*'

# Load Balancer Security group
  PublicLoadBalancerSG:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Access to the public facing load balancer from entire internet range
      VpcId: !Ref FargateVpc
      SecurityGroupIngress:
        - CidrIp: 0.0.0.0/0
          IpProtocol: -1

# Fargate Container Security Group
  FargateContainerSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties: 
      GroupDescription: Access to fargate containers
      VpcId: !Ref FargateVpc    

  EcsSecurityGroupIngressFromPublicALB:
    Type: AWS::EC2::SecurityGroupIngress
    Properties:
      Description: Ingress from the public ALB 
      GroupId: !Ref FargateContainerSecurityGroup   
      IpProtocol: -1
      SourceSecurityGroupId: !Ref PublicLoadBalancerSG

  EcsSecurityGroupIngressFromSelf:
    Type: AWS::EC2::SecurityGroupIngress
    Properties:
      Description: Ingress from other containers in the same security group 
      GroupId: !Ref FargateContainerSecurityGroup
      IpProtocol: -1
      SourceSecurityGroupId: !Ref FargateContainerSecurityGroup

# Load Balancer
  PublicLoadBalancer:
    Type: AWS::ElasticLoadBalancingV2::LoadBalancer 
    Properties:
      Scheme: internet-facing 
      LoadBalancerAttributes: 
        - Key: idle_timeout.timeout_seconds
          Value: '30'
      Subnets: 
        - !Ref PublicSubnetOne 
        - !Ref PublicSubnetTwo 
      SecurityGroups: [!Ref 'PublicLoadBalancerSG']      

# Target Group
  DummyTargetGroupPublic:
    Type: AWS::ElasticLoadBalancingV2::TargetGroup
    Properties:
      HealthCheckIntervalSeconds: 6
      HealthCheckPath: /
      HealthCheckProtocol: HTTP
      HealthCheckTimeoutSeconds: 5
      HealthyThresholdCount: 2
      Name: !Join ['-', [!Ref 'AWS::StackName', 'drop-1']]
      Port: 80
      Protocol: HTTP
      UnhealthyThresholdCount: 2
      VpcId: !Ref 'FargateVpc'

# Listener
  PublicLoadBalancerListener: 
    Type: AWS::ElasticLoadBalancingV2::Listener
    DependsOn:  
      - PublicLoadBalancer     
    Properties:
      DefaultActions:
        - TargetGroupArn: !Ref 'DummyTargetGroupPublic'
          Type: 'forward'
      LoadBalancerArn: !Ref 'PublicLoadBalancer'      
      Port: 80
      Protocol: HTTP    

Outputs:
  VPCId:
    Description: The ID of the vpc that this stack is deployed on 
    Value: !Ref FargateVpc
    Export: 
      Name: !Join [':', [!Ref 'AWS::StackName', 'VPCId']]      
  PublicSubnetOne:
    Description: Public subnet one
    Value: !Ref 'PublicSubnetOne'
    Export:
      Name: !Join [ ':', [ !Ref 'AWS::StackName', 'PublicSubnetOne' ] ]
  PublicSubnetTwo:
    Description: Public subnet two
    Value: !Ref 'PublicSubnetTwo'
    Export:
      Name: !Join [ ':', [ !Ref 'AWS::StackName', 'PublicSubnetTwo' ] ]
  FargateContainerSecurityGroup:
    Description: A security group used to allow Fargate containers to receive traffic
    Value: !Ref 'FargateContainerSecurityGroup'
    Export:
      Name: !Join [ ':', [ !Ref 'AWS::StackName', 'FargateContainerSecurityGroup' ] ]      
# ECS Outputs      
  ClusterName:
    Description: The name of the ECS cluster
    Value: !Ref 'ECSCluster'
    Export:
      Name: !Join [ ':', [ !Ref 'AWS::StackName', 'ClusterName' ] ]
  ECSRole:
    Description: The ARN of the ECS role
    Value: !GetAtt 'ECSRole.Arn'
    Export:
      Name: !Join [ ':', [ !Ref 'AWS::StackName', 'ECSRole' ] ]
  ECSTaskExecutionRole:
    Description: The ARN of the ECS role
    Value: !GetAtt 'ECSTaskExecutionRole.Arn'
    Export:
      Name: !Join [ ':', [ !Ref 'AWS::StackName', 'ECSTaskExecutionRole' ] ]
  PublicListener:
    Description: The ARN of the public load balancer's Listener
    Value: !Ref PublicLoadBalancerListener
    Export:
      Name: !Join [ ':', [ !Ref 'AWS::StackName', 'PublicListener' ] ]          
  ExternalUrl:
    Description: The url of the external load balancer
    Value: !Join ['', ['http://', !GetAtt 'PublicLoadBalancer.DNSName']]
    Export:
      Name: !Join [ ':', [ !Ref 'AWS::StackName', 'ExternalUrl' ] ]            

2) Сервисный стек

AWSTemplateFormatVersion: '2010-09-09'
Description: Deploy a service on AWS Fargate, hosted in a public subnet of a VPC, and accessible via a public load balancer

# Input Paramters
Parameters:
  StackName: 
    Type: String
    Default: test-fargate
    Description: The name of the parent fargate networking stack
  ServiceName:
    Type: String
    Default: nginx
    Description: Name of the ECS service
  ImageUrl:
    Type: String
    Default: nginx
    Description: The url of a docker image that contains the application process that
                 will handle the traffic for this service
  ContainerPort:
    Type: Number
    Default: 80
    Description: What port number the application inside the docker container is binding to
  ContainerCpu:
    Type: Number
    Default: 256
    Description: How much CPU to give the container. 1024 is 1 CPU
  ContainerMemory:
    Type: Number
    Default: 512
    Description: How much memory in megabytes to give the container
  Path:
    Type: String
    Default: "*"
    Description: A path on the public load balancer that this service
                 should be connected to. Use * to send all load balancer
                 traffic to this service.
  Priority:
    Type: Number
    Default: 1
    Description: The priority for the routing rule added to the load balancer.
                 This only applies if your have multiple services which have been
                 assigned to different paths on the load balancer.
  DesiredCount:
    Type: Number
    Default: 2
    Description: How many copies of the service task to run
  Role:
    Type: String
    Default: ""
    Description: (Optional) An IAM role to give the service's containers if the code within needs to
                 access other AWS resources like S3 buckets, DynamoDB tables, etc

Conditions: 
  HasCustomRole: !Not [!Equals [!Ref 'Role', '']]                 

# Task Definition  
Resources: 
  TaskDefinition:
    Type: AWS::ECS::TaskDefinition 
    Properties: 
      Family: !Ref 'ServiceName'
      Cpu: !Ref 'ContainerCpu'
      Memory: !Ref 'ContainerMemory'
      NetworkMode: awsvpc
      RequiresCompatibilities: 
        - FARGATE 
      ExecutionRoleArn:
        Fn::ImportValue: 
          !Join [':', [!Ref 'StackName', 'ECSTaskExecutionRole']]  
      TaskRoleArn:
        Fn::If: 
          - 'HasCustomRole' 
          - !Ref 'Role'
          - !Ref "AWS::NoValue"         
      ContainerDefinitions:
        - Name: !Ref 'ServiceName'
          Cpu: !Ref 'ContainerCpu'
          Memory: !Ref 'ContainerMemory'
          Image: !Ref 'ImageUrl'
          PortMappings: 
            - ContainerPort: !Ref 'ContainerPort'      

# ALB Target Group
  TargetGroup:
    Type: AWS::ElasticLoadBalancingV2::TargetGroup 
    Properties: 
      HealthCheckIntervalSeconds: 6
      HealthCheckPath: /
      HealthCheckProtocol: HTTP 
      HealthCheckTimeoutSeconds: 5
      HealthyThresholdCount: 2
      TargetType: ip 
      Name: !Ref 'ServiceName'
      Port: !Ref 'ContainerPort'
      Protocol: HTTP 
      UnhealthyThresholdCount: 2
      VpcId:                     
        Fn::ImportValue:
          !Join [':', [!Ref 'StackName', 'VPCId']]

# ALB Rule
  LoadBalancerRule:
    Type: AWS::ElasticLoadBalancingV2::ListenerRule
    Properties:
      Actions:
        - TargetGroupArn: !Ref 'TargetGroup'       
          Type: 'forward'
      Conditions:
        - Field: path-pattern
          Values: [!Ref 'Path']       
      ListenerArn: 
        Fn::ImportValue:
          !Join [':', [!Ref 'StackName', 'PublicListener']] 
      Priority: !Ref 'Priority'                         

# ECS or Fargate Service     
  Service: 
    Type: AWS::ECS::Service 
    DependsOn: LoadBalancerRule 
    Properties: 
      ServiceName: !Ref 'ServiceName'
      Cluster: 
        Fn::ImportValue: 
          !Join [':', [!Ref 'StackName', 'ClusterName']] 
      LaunchType: FARGATE 
      DeploymentConfiguration: 
        MaximumPercent: 200
        MinimumHealthyPercent: 75
      DesiredCount: !Ref 'DesiredCount'    
      NetworkConfiguration: 
        AwsvpcConfiguration:
          AssignPublicIp: ENABLED
          SecurityGroups: 
            - Fn::ImportValue:
                !Join [':', [!Ref 'StackName', 'FargateContainerSecurityGroup']]    
          Subnets:
            - Fn::ImportValue:
                !Join [':', [!Ref 'StackName', 'PublicSubnetOne']]                          
            - Fn::ImportValue:
                !Join [':', [!Ref 'StackName', 'PublicSubnetTwo']]    
      TaskDefinition:  !Ref TaskDefinition
      LoadBalancers:
        - ContainerName: !Ref 'ServiceName'
          ContainerPort: !Ref 'ContainerPort'
          TargetGroupArn: !Ref 'TargetGroup'                                                       

Answer 1

На основании комментариев.

Проблема заключалась в том, что первый и второй шаблоны были развернуты в одном стеке. Решением было развернуть второй шаблон как отдельный стек.