使用 EC2 时，ECS 集群无法在私有子网中运行任务

Question

我有一个配置为使用 awsvpc 网络模式的任务定义。根据 this:

Only private subnets are supported for the awsvpc network mode. Because tasks do not receive public IP addresses, a NAT gateway is required for outbound internet access, and inbound internet traffic should be routed through a load balancer.

我在 public 子网（具有互联网网关）中设置了 NAT 网关，并在私有子网中配置路由 table 以将流量发送到 NAT 网关。但是当我想创建一个驻留在私有子网中的任务时，我得到：

Run tasks failed Reasons : ["ATTRIBUTE"]. Learn more

如果我选择 EC2 本身使用的 public 子网，它会创建任务。但是我无法在我的任务中访问互联网。
我的最终目标是通过我在 EC2 中的任务访问互联网。

更新：我的任务定义：

{
"ipcMode": null,
"executionRoleArn": "arn:aws:iam::783294628224:role/ecsTaskExecutionRole",
"containerDefinitions": [
{
"dnsSearchDomains": null,
"logConfiguration": {
"logDriver": "awslogs",
"options": {
"awslogs-group": "/ecs/TEST-Task-Definition",
"awslogs-region": "us-west-2",
"awslogs-stream-prefix": "ecs"
}
},
"entryPoint": null,
"portMappings": [
{
"hostPort": 8500,
"protocol": "tcp",
"containerPort": 8500
},
{
"hostPort": 8501,
"protocol": "tcp",
"containerPort": 8501
}
],
"command": null,
"linuxParameters": null,
"cpu": 0,
"environment": [],
"resourceRequirements": null,
"ulimits": null,
"dnsServers": null,
"mountPoints": [],
"workingDirectory": null,
"secrets": null,
"dockerSecurityOptions": null,
"memory": null,
"memoryReservation": 500,
"volumesFrom": [],
"stopTimeout": null,
"image": "<MY ECR REPOSITORY ADDRESS FOR IMAGE 1>",
"startTimeout": null,
"dependsOn": null,
"disableNetworking": null,
"interactive": null,
"healthCheck": null,
"essential": true,
"links": null,
"hostname": null,
"extraHosts": null,
"pseudoTerminal": null,
"user": "root",
"readonlyRootFilesystem": null,
"dockerLabels": null,
"systemControls": null,
"privileged": true,
"name": "backend"
},
{
"dnsSearchDomains": null,
"logConfiguration": {
"logDriver": "awslogs",
"options": {
"awslogs-group": "/ecs/TEST-Task-Definition",
"awslogs-region": "us-west-2",
"awslogs-stream-prefix": "ecs"
}
},
"entryPoint": null,
"portMappings": [
{
"hostPort": 80,
"protocol": "tcp",
"containerPort": 80
}
],
"command": null,
"linuxParameters": null,
"cpu": 0,
"environment": [],
"resourceRequirements": null,
"ulimits": null,
"dnsServers": null,
"mountPoints": [],
"workingDirectory": null,
"secrets": null,
"dockerSecurityOptions": null,
"memory": null,
"memoryReservation": 500,
"volumesFrom": [],
"stopTimeout": null,
"image": "<MY ECR REPOSITORY ADDRESS FOR IMAGE 2>",
"startTimeout": null,
"dependsOn": null,
"disableNetworking": null,
"interactive": null,
"healthCheck": null,
"essential": true,
"links": null,
"hostname": null,
"extraHosts": null,
"pseudoTerminal": null,
"user": "root",
"readonlyRootFilesystem": null,
"dockerLabels": null,
"systemControls": null,
"privileged": true,
"name": "frontend"
}
],
"memory": null,
"taskRoleArn": "arn:aws:iam::783294628224:role/ecsTaskExecutionRole",
"family": "TEST-Task-Definition",
"pidMode": null,
"requiresCompatibilities": [
"EC2"
],
"networkMode": "awsvpc",
"cpu": null,
"proxyConfiguration": null,
"volumes": [],
"placementConstraints": []
}

Answer 1

如果你不使用https://docs.aws.amazon.com/AmazonECS/latest/developerguide/ecs-optimized_AMI.html

确保您已将代理参数环境密钥 ECS_ENABLE_TASK_ENI 设置为 true

Answer 2

我终于成功解决了我的问题。据我所知，在任务定义中使用 awsvpc 网络模式时，任务（或服务）必须在 EC2 子网中创建。此外，如果您希望您的任务能够访问 Internet，您应该在另一个子网中创建一个 NAT 网关，该子网具有到驻留在您的 VPC 中的 Internet 网关的默认路由。在 task/service/EC2 子网中，您必须添加到 NAT 网关的默认路由。出现的唯一问题是您不能再通过 ssh 连接到您的 EC2。如果你想通过 ssh 连接到你的 EC2，我认为你应该设置一个负载均衡器。

使用 EC2 时，ECS 集群无法在私有子网中运行任务

ECS cluster cannot run tasks in private subnet when using EC2

amazon-ec2

amazon-web-services

amazon-ecs

使用 EC2 时，ECS 集群无法在私有子网中 运行 任务

ECS cluster cannot run tasks in private subnet when using EC2

amazon-ec2

amazon-web-services

amazon-ecs

使用 EC2 时，ECS 集群无法在私有子网中运行任务