Creating an ALB Target Group in CloudFormation

I'm trying to create an Application Load Balancer in CloudFormation, with a target group that forwards traffic to EC2 instances. Here is the relevant snippet, where ELBSubnets, ECSCluster, taskdefinition, and VpcId are passed in as parameters:

"EcsElasticLoadBalancer" : { "Type" : "AWS::ElasticLoadBalancingV2::LoadBalancer", "Properties" : { "Subnets" : { "Ref" : "ELBSubnets" }, "SecurityGroups": [ { "Ref": "ELBAccessSecurityGroup" } ] } }, "LoadBalancerListener": { "Type": "AWS::ElasticLoadBalancingV2::Listener", "Properties": { "DefaultActions": [{ "Type": "forward", "TargetGroupArn": { "Ref": "TargetGroup" } }], "LoadBalancerArn": { "Ref": "EcsElasticLoadBalancer" }, "Port": 80, "Protocol": "HTTP" } }, "TargetGroup": { "Type": "AWS::ElasticLoadBalancingV2::TargetGroup", "Properties": { "Name": { "Fn::Join": [ "-", [ { "Ref": "AWS::StackName" }, "TargetGroup" ] ] }, "Port": 80, "Protocol": "HTTP", "VpcId": { "Ref": "VpcId" } }, "DependsOn": [ "EcsElasticLoadBalancer" ] }, "service": { "Type": "AWS::ECS::Service", "Properties" : { "Cluster": { "Ref": "ECSCluster" }, "DesiredCount": "1", "LoadBalancers": [ { "ContainerName": "main-app", "ContainerPort": 3000, "TargetGroupArn": { "Ref": "TargetGroup" } } ], "Role" : {"Ref":"ECSServiceRole"}, "TaskDefinition" : {"Ref":"taskdefinition"} } }, "ECSServiceRole": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Effect": "Allow", "Principal": { "Service": [ "ecs.amazonaws.com" ] }, "Action": [ "sts:AssumeRole" ] } ] }, "Path": "/", "Policies": [ { "PolicyName": "ecs-service", "PolicyDocument": { "Statement": [ { "Effect": "Allow", "Action": [ "elasticloadbalancing:Describe*", "elasticloadbalancing:DeregisterInstancesFromLoadBalancer", "elasticloadbalancing:RegisterInstancesWithLoadBalancer", "ec2:Describe*", "ec2:AuthorizeSecurityGroupIngress" ], "Resource": "*" } ] } } ] } } 

I get the following error when creating the service:

The target group with targetGroupArn arn:aws:elasticloadbalancing:us-east-1:xxxxxxxx:targetgroup/AlbServiceStack-TargetGroup/6ba9c037c26cdb36 does not have an associated load balancer.

What am I missing? In the documentation there doesn't seem to be a way to specify a load balancer for the target group.

1 Answer

Got it working - the problem was twofold:

1. The following lines were missing from the Role PolicyDocument:
   • "elasticloadbalancing:DeregisterTargets"
   • "elasticloadbalancing:RegisterTargets"
2. The service needed "DependsOn": [ "LoadBalancerListener" ] as an additional attribute.

Updated template looks like this:

"EcsElasticLoadBalancer" : { "Type" : "AWS::ElasticLoadBalancingV2::LoadBalancer", "Properties" : { "Subnets" : { "Ref" : "ELBSubnets" }, "SecurityGroups": [ { "Ref": "ELBAccessSecurityGroup" } ] } }, "LoadBalancerListener": { "Type": "AWS::ElasticLoadBalancingV2::Listener", "Properties": { "DefaultActions": [{ "Type": "forward", "TargetGroupArn": { "Ref": "TargetGroup" } }], "LoadBalancerArn": { "Ref": "EcsElasticLoadBalancer" }, "Port": 80, "Protocol": "HTTP" } }, "TargetGroup": { "Type": "AWS::ElasticLoadBalancingV2::TargetGroup", "Properties": { "Name": { "Fn::Join": [ "-", [ { "Ref": "AWS::StackName" }, "TargetGroup" ] ] }, "Port": 80, "Protocol": "HTTP", "VpcId": { "Ref": "VpcId" } }, "DependsOn": [ "EcsElasticLoadBalancer" ] }, "service": { "Type": "AWS::ECS::Service", "DependsOn": [ "LoadBalancerListener" ], "Properties" : { "Cluster": { "Ref": "ECSCluster" }, "DesiredCount": "1", "LoadBalancers": [ { "ContainerName": "main-app", "ContainerPort": 3000, "TargetGroupArn": { "Ref": "TargetGroup" } } ], "Role" : {"Ref":"ECSServiceRole"}, "TaskDefinition" : {"Ref":"taskdefinition"} } }, "ECSServiceRole": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Effect": "Allow", "Principal": { "Service": [ "ecs.amazonaws.com" ] }, "Action": [ "sts:AssumeRole" ] } ] }, "Path": "/", "Policies": [ { "PolicyName": "ecs-service", "PolicyDocument": { "Statement": [ { "Effect": "Allow", "Action": [ "elasticloadbalancing:Describe*", "elasticloadbalancing:DeregisterInstancesFromLoadBalancer", "elasticloadbalancing:RegisterInstancesWithLoadBalancer", "ec2:Describe*", "ec2:AuthorizeSecurityGroupIngress", "elasticloadbalancing:DeregisterTargets", "elasticloadbalancing:RegisterTargets" ], "Resource": "*" } ] } } ] } }