Fargate error: cannot pull container hosted in ECR from a private subnet

Question

我正在尝试创建以下架构：一个具有两个子网的 vpc（一个是 public 包含一个 NatGateway 和一个 InternetGateway，另一个是私有的。

我在私有子网中启动了 fargate 服务，但失败并出现此错误：

CannotPullContainerError: API error (500): Get https://XYZ.dkr.ecr.us-east-1.amazonaws.com/v2/: net/http: request cancelled while waiting for connection (Client.Timeout exceeded while awaiting headers)

这是我的 CloudFormation 模板（该服务被故意注释掉，ECR 图像 url 被打乱）：

Resources:
#Network resources: VPC 
  WorkflowVpc:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: "10.0.0.0/16"
      EnableDnsSupport: false
      Tags:
        - Key: Project
          Value: Workflow
#PublicSubnet
  WorkflowPublicSubnet:
    Type: AWS::EC2::Subnet
    Properties:
      CidrBlock: "10.0.0.0/24"
      VpcId: 
        Ref: WorkflowVpc
  WorkflowInternetGateway:
    Type: AWS::EC2::InternetGateway
  WorkflowVCPGatewayAttachment:
    DependsOn: 
      - WorkflowInternetGateway
      - WorkflowVpc
    Type: AWS::EC2::VPCGatewayAttachment
    Properties:
      InternetGatewayId:
        Ref: WorkflowInternetGateway
      VpcId:
        Ref: WorkflowVpc
  WorkflowElasticIp:
    Type: AWS::EC2::EIP
    Properties:
      Domain: vpc
  WorkflowPublicSubnetRouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: 
        Ref: WorkflowVpc
  PublicSubnetToRouteTable:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      RouteTableId:
        Ref: WorkflowPublicSubnetRouteTable
      SubnetId: 
        Ref: WorkflowPublicSubnet
  WorkflowInternetRoute:
    Type: AWS::EC2::Route
    Properties:
      RouteTableId:
        Ref: WorkflowPublicSubnetRouteTable
      DestinationCidrBlock: 0.0.0.0/0
      GatewayId: 
        Ref: WorkflowInternetGateway
  WorkflowNat:
    DependsOn: 
      - WorkflowVCPGatewayAttachment
      - WorkflowElasticIp
    Type: AWS::EC2::NatGateway
    Properties:
      AllocationId: 
        Fn::GetAtt:
          - WorkflowElasticIp
          - AllocationId
      SubnetId:
        Ref: WorkflowPublicSubnet
#Private subnet          
  WorkflowPrivateSubnet:
    Type: AWS::EC2::Subnet
    Properties:
      CidrBlock: "10.0.1.0/24"
      VpcId: 
        Ref: WorkflowVpc
  WorkflowPrivateSubnetRouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: 
        Ref: WorkflowVpc
  PrivateSubnetToRouteTable:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      RouteTableId:
        Ref: WorkflowPrivateSubnetRouteTable
      SubnetId: 
        Ref: WorkflowPrivateSubnet
  WorkflowNatRoute:
    Type: AWS::EC2::Route
    Properties:
      RouteTableId:
        Ref: WorkflowPrivateSubnetRouteTable
      DestinationCidrBlock: 0.0.0.0/0
      NatGatewayId: 
        Ref: WorkflowNat
#Fargate:
  WorkflowFargateTask:
    Type: AWS::ECS::TaskDefinition
    Properties:
      RequiresCompatibilities: 
        - "FARGATE"
      Cpu: "256"
      Memory: "0.5GB"
      ContainerDefinitions:
        - Name: WorkflowFargateContainer
          Image: "XYZ.dkr.ecr.us-east-1.amazonaws.com/workflow:latest"
      NetworkMode: awsvpc
      ExecutionRoleArn: "arn:aws:iam::XXX:role/ecsTaskExecutionRole"

  WorkflowCluster:
    Type: AWS::ECS::Cluster
    Properties:
      ClusterName: WorkflowServiceCluster

#  WorkflowService:
#    DependsOn: 
#      - WorkflowNatRoute
#    Type: AWS::ECS::Service
#    Properties:
#      Cluster: 
#        Ref: WorkflowCluster
#      DesiredCount: 1
#      TaskDefinition:
#        Ref: WorkflowFargateTask
#      NetworkConfiguration:
#        AwsvpcConfiguration: 
#          AssignPublicIp: DISABLED
#          Subnets: 
#            - Ref: WorkflowPrivateSubnet
#      LaunchType: FARGATE

我还尝试在 public 子网中设置 AssignPublicIp: ENABLED，它工作得很好，但这不是我的目标。

所以，我的问题是：我的模板是否正常，是否是 Fargate/ECR 的问题？

此外，调试此类行为的最佳方法是什么？ CloudWatch 似乎没有关于此错误的日志...

Answer 1

根据 Steve E 的提示，我发现可以访问互联网，唯一的问题是 VPC 的这个参数：

EnableDnsSupport: false

当然，当我尝试更新 linux 软件包或 ping google.com 时，它无法解析主机名。将其切换为 "true" 解决了问题。

Fargate error: cannot pull container hosted in ECR from a private subnet

Fargate error: cannot pull container hosted in ECR from a private subnet

amazon-ecs

aws-vpc

aws-fargate