亚马逊 ElastiCache Redis 公共访问

Question

I have an Amazon AWS account.I want to use ElastiCache Redis. I've installed ElastiCache Redis. How i connect ElastiCache Redis from public address?

I've installed Amazon Linux AMI. I'am accessing ElastiCache Redis from it.But i want to access from public address.

Answer 1

[Update] As mentioned by Luke below, this is now possible. Below is the reference. https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/accessing-elasticache.html#access-from-outside-aws

Sadly no. You may refer to this question.

Can you connect to Amazon ElastiСache Redis outside of Amazon?

which provides a reference to

http://aws.amazon.com/elasticache/faqs/#Can_I_access_Amazon_ElastiCache_from_outside_AWS

that states

Amazon ElastiCache Cluster, inside or outside a VPC, is never allowed to be accessed from the Internet.

Answer 2

If you want to access Amazon ElastiCache Nodes, deployed within a VPC, from the Internet or from EC2 Instances outside the VPC, please see guidelines here. http://docs.aws.amazon.com/AmazonElastiCache/latest/UserGuide/Access.Outside.html

Answer 3

My current approach for development purposes is to

1. Create a Cloud9 instance in the same VPC as my Elasticache instance.
2. Add a security group rule to the Elasticache instance to allow traffic from the Cloud9 instance security group.
3. Run a tiny TCP proxy (written in Go) in the Cloud9 instance that proxies traffic to and from the Elasticache instance.

# main.go
package main

import (
    "flag"
    "fmt"
    "io"
    "net"
    "sync"
)

var localAddr *string = flag.String("l", "localhost:9999", "local address")
var remoteAddr *string = flag.String("r", "localhost:80", "remote address")

func proxyConn(conn *net.TCPConn) {
    rAddr, err := net.ResolveTCPAddr("tcp", *remoteAddr)
    if err != nil {
        panic(err)
    }

    rConn, err := net.DialTCP("tcp", nil, rAddr)
    if err != nil {
        panic(err)
    }
    defer rConn.Close()

    var wg sync.WaitGroup
    wg.Add(1)
    go func() {
        io.Copy(conn, rConn)
        // conn2 has returned EOF or an error, so we need to shut down the
        // other half of the duplex copy.
        conn.Close()
        wg.Done()
    }()

    wg.Add(1)
    go func() {
        io.Copy(rConn, conn)
        rConn.Close()
        wg.Done()
    }()

    wg.Wait()
}

func main() {
    flag.Parse()

    fmt.Printf("Listening: %v\nProxying: %v\n\n", *localAddr, *remoteAddr)

    addr, err := net.ResolveTCPAddr("tcp", *localAddr)
    if err != nil {
        panic(err)
    }

    listener, err := net.ListenTCP("tcp", addr)
    if err != nil {
        panic(err)
    }

    for {
        conn, err := listener.AcceptTCP()

        if err != nil {
            panic(err)
        }

        fmt.Println("handling connection")
        go func() {
            proxyConn(conn)
            fmt.Println("connection closed")
        }()

    }
}

# run commands
go run main.go -l 0.0.0.0:9999 -r <redacted>.use1.cache.amazonaws.com:6379

4. Ensure the security group of the Cloud9 instance allows public access to the port where the proxy is running (eg 9999). And grab the Cloud9 instance public IP from the share dialog (eg XXXX)
5. Consume your Elasticache instance from the public proxy endpoint (eg XXXX:9999)

The Cloud9 instance could be substituted with any other EC2 instance. Obviously there are performance costs to adding all those hops. But it works.

Answer 4

This is kind of ambiguous, but the short answer is that this is not normally possible. ECS is private, by definition, because it is in memory store and needs blazing fast speed. Allowing access from the internet is not conducive to blazing fast speed. About the only workaround you could hope for would be to access the cluster via VPN, as per the AWS Documentation[1].

Important Opening up the ElastiCache cluster to 0.0.0.0/0 does not expose the cluster to the Internet because it has no public IP address and therefore cannot be accessed from outside the VPC. However, the default security group may be applied to other Amazon EC2 instances in the customer's account, and those instances may have a public IP address. If they happen to be running something on the default port, then that service could be exposed unintentionally. Therefore, we recommend creating a VPC Security Group that will be used exclusively by ElastiCache[2].

-----References----- [1] https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/accessing-elasticache.html#access-from-outside-aws [2] https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/accessing-elasticache.html#access-from-outside-aws