使用EC2時，ECS群集無法在專用子網中運行任務

Question

我有一個配置為使用awsvpc網絡模式的任務定義。 根據此 ：

awsvpc網絡模式僅支持專用子網。 由於任務沒有收到公共IP地址，因此出站Internet訪問需要NAT網關，並且入站Internet通信應通過負載均衡器進行路由。

我在公共子網（具有Internet網關）中設置了NAT網關，並在私有子網中配置了路由表，以將流量發送到NAT網關。 但是，當我想創建一個駐留在專用子網中的任務時，我得到：

Run tasks failed Reasons : ["ATTRIBUTE"]. Learn more

如果我選擇EC2本身使用的公共子網，它將創建任務。 但是我無法在任務中訪問Internet。
我的最終目標是從EC2中的任務訪問Internet。

更新：我的任務定義：

{
"ipcMode": null,
"executionRoleArn": "arn:aws:iam::783294628224:role/ecsTaskExecutionRole",
"containerDefinitions": [
{
"dnsSearchDomains": null,
"logConfiguration": {
"logDriver": "awslogs",
"options": {
"awslogs-group": "/ecs/TEST-Task-Definition",
"awslogs-region": "us-west-2",
"awslogs-stream-prefix": "ecs"
}
},
"entryPoint": null,
"portMappings": [
{
"hostPort": 8500,
"protocol": "tcp",
"containerPort": 8500
},
{
"hostPort": 8501,
"protocol": "tcp",
"containerPort": 8501
}
],
"command": null,
"linuxParameters": null,
"cpu": 0,
"environment": [],
"resourceRequirements": null,
"ulimits": null,
"dnsServers": null,
"mountPoints": [],
"workingDirectory": null,
"secrets": null,
"dockerSecurityOptions": null,
"memory": null,
"memoryReservation": 500,
"volumesFrom": [],
"stopTimeout": null,
"image": "<MY ECR REPOSITORY ADDRESS FOR IMAGE 1>",
"startTimeout": null,
"dependsOn": null,
"disableNetworking": null,
"interactive": null,
"healthCheck": null,
"essential": true,
"links": null,
"hostname": null,
"extraHosts": null,
"pseudoTerminal": null,
"user": "root",
"readonlyRootFilesystem": null,
"dockerLabels": null,
"systemControls": null,
"privileged": true,
"name": "backend"
},
{
"dnsSearchDomains": null,
"logConfiguration": {
"logDriver": "awslogs",
"options": {
"awslogs-group": "/ecs/TEST-Task-Definition",
"awslogs-region": "us-west-2",
"awslogs-stream-prefix": "ecs"
}
},
"entryPoint": null,
"portMappings": [
{
"hostPort": 80,
"protocol": "tcp",
"containerPort": 80
}
],
"command": null,
"linuxParameters": null,
"cpu": 0,
"environment": [],
"resourceRequirements": null,
"ulimits": null,
"dnsServers": null,
"mountPoints": [],
"workingDirectory": null,
"secrets": null,
"dockerSecurityOptions": null,
"memory": null,
"memoryReservation": 500,
"volumesFrom": [],
"stopTimeout": null,
"image": "<MY ECR REPOSITORY ADDRESS FOR IMAGE 2>",
"startTimeout": null,
"dependsOn": null,
"disableNetworking": null,
"interactive": null,
"healthCheck": null,
"essential": true,
"links": null,
"hostname": null,
"extraHosts": null,
"pseudoTerminal": null,
"user": "root",
"readonlyRootFilesystem": null,
"dockerLabels": null,
"systemControls": null,
"privileged": true,
"name": "frontend"
}
],
"memory": null,
"taskRoleArn": "arn:aws:iam::783294628224:role/ecsTaskExecutionRole",
"family": "TEST-Task-Definition",
"pidMode": null,
"requiresCompatibilities": [
"EC2"
],
"networkMode": "awsvpc",
"cpu": null,
"proxyConfiguration": null,
"volumes": [],
"placementConstraints": []
}

Answer 1

如果您不使用https://docs.aws.amazon.com/AmazonECS/latest/developerguide/ecs-optimized_AMI.html

確保已將代理程序參數環境密鑰ECS_ENABLE_TASK_ENI為true

Answer 2

我終於成功解決了我的問題。 據我所知，在“任務定義”中使用awsvpc網絡模式時，必須在EC2子網中創建任務（或服務）。 另外，如果您希望您的任務可以訪問Internet，則應在另一個子網中創建NAT網關，該子網具有到位於VPC中的Internet網關的默認路由。 在任務/服務/ EC2子網中，您必須向NAT網關添加默認路由。 發生的唯一問題是您不能再使用SSH了。 如果您想使用EC2，我認為您應該設置負載均衡器。