From 115e67ba23870995d4e6a2c74bd819c51627b254 Mon Sep 17 00:00:00 2001 From: zjdMASTER Date: Tue, 21 Jul 2026 04:17:22 +0800 Subject: [PATCH] fix(deploy): define missing AllowedCIDR parameter and allow HTTP to ALB The CloudFormation template referenced an AllowedCIDR parameter in the ALB security group ingress rule, but the parameter was never declared. CloudFormation rejects the template with an unresolved-dependency error, so the one-click deploy (deploy/deploy.sh) fails for both EC2 and ECS modes before any resource is created. Declare the AllowedCIDR parameter, and open the ALB security group on port 80 to match the HTTP listener that the stack actually creates (the ingress previously only permitted 443, for which there is no listener, leaving the ALB unreachable). Port 443 is kept for the documented post-deploy ACM/HTTPS listener. --- deploy/cfn-agentic-data.yaml | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/deploy/cfn-agentic-data.yaml b/deploy/cfn-agentic-data.yaml index 49bb327..74286e8 100644 --- a/deploy/cfn-agentic-data.yaml +++ b/deploy/cfn-agentic-data.yaml @@ -35,6 +35,12 @@ Parameters: Default: "10.0.0.0/16" AllowedPattern: '(\d{1,3}\.){3}\d{1,3}/\d{1,2}' + AllowedCIDR: + Type: String + Default: "10.0.0.0/8" + AllowedPattern: '(\d{1,3}\.){3}\d{1,3}/\d{1,2}' + Description: "CIDR allowed to reach the ALB. Override with your public IP/range; never use 0.0.0.0/0." + ContainerImageUri: Type: String Description: "ECR image URI (account.dkr.ecr.region.amazonaws.com/repo:tag)" @@ -321,11 +327,16 @@ Resources: GroupDescription: ALB - HTTPS from allowed sources only (NO 0.0.0.0/0) VpcId: !Ref VPC SecurityGroupIngress: + - IpProtocol: tcp + FromPort: 80 + ToPort: 80 + CidrIp: !Ref AllowedCIDR + Description: "HTTP from allowed CIDRs" - IpProtocol: tcp FromPort: 443 ToPort: 443 CidrIp: !Ref AllowedCIDR - Description: "HTTPS from allowed CIDRs" + Description: "HTTPS from allowed CIDRs (post-deploy ACM listener)" SecurityGroupEgress: - IpProtocol: "-1" CidrIp: "0.0.0.0/0"