"Execution failed" 使用 AWS CDK 设置 API Gateway 和 Fargate 时

Question

我正在尝试设置 AWS API 网关以访问私有 VPC 中的 fargate 容器，如 here 所述。为此，我使用如下所述的 AWS CDK。但是当我在成功 cdk deploy 后卷曲端点时，我得到 "Internal Server Error" 作为响应。我找不到任何其他信息。由于某种原因 API GW 无法到达容器。

所以当我像这样卷曲端点时：

curl - i https://xxx.execute-api.eu-central-1.amazonaws.com/prod/MyResource

...我在云监视中得到以下日志输出：

Extended Request Id: NpuEPFWHliAFm_w=
Verifying Usage Plan for request: 757c6b9e-c4af-4dab-a5b1-542b15a1ba21. API Key: API Stage: ...
PI Key authorized because method 'ANY /MyResource/{proxy+}' does not require API Key. Request will not contribute to throttle or quota limits
Usage Plan check succeeded for API Key and API Stage ...
Starting execution for request: 757c6b9e-c4af-4dab-a5b1-542b15a1ba21
HTTP Method: GET, Resource Path: /MyResource/test
Execution failed due to configuration error: There was an internal error while executing your request

CDK 代码

首先我创建了一个网络负载均衡的 Fargate 服务：

private setupService(): NetworkLoadBalancedFargateService {
    const vpc = new Vpc(this, 'MyVpc');

    const cluster = new Cluster(this, 'MyCluster', {
      vpc: vpc,
    });
    cluster.connections.allowFromAnyIpv4(Port.tcp(5050));

    const taskDefinition = new FargateTaskDefinition(this, 'MyTaskDefinition');

    const container = taskDefinition.addContainer('MyContainer', {
      image: ContainerImage.fromRegistry('vad1mo/hello-world-rest'),
    });
    container.addPortMappings({
      containerPort: 5050,
      hostPort: 5050,
    });

    const service = new NetworkLoadBalancedFargateService(this, 'MyFargateServie', {
      cluster,
      taskDefinition,
      assignPublicIp: true,
    });

    service.service.connections.allowFromAnyIpv4(Port.tcp(5050));

    return service;
}

接下来我创建 VpcLink 和 API 网关：

private setupApiGw(service: NetworkLoadBalancedFargateService) {
   const api = new RestApi(this, `MyApi`, {
      restApiName: `MyApi`,
      deployOptions: {
        loggingLevel: MethodLoggingLevel.INFO,
      },
    });

    // setup api resource which forwards to container
    const resource = api.root.addResource('MyResource');
    resource.addProxy({
      anyMethod: true,
      defaultIntegration: new HttpIntegration('http://localhost.com:5050', {
        httpMethod: 'ANY',
        options: {
          connectionType: ConnectionType.VPC_LINK,
          vpcLink: new VpcLink(this, 'MyVpcLink', {
              targets: [service.loadBalancer],
              vpcLinkName: 'MyVpcLink',
          }),
        },
        proxy: true,
      }),
      defaultMethodOptions: {
        authorizationType: AuthorizationType.NONE,
      },
    });
    resource.addMethod('ANY');
    this.addCorsOptions(resource);
}

有人知道这个配置有什么问题吗？

Answer 1

经过几个小时的尝试，我终于发现在使用 CDK 设置 VpcLink 时，安全组似乎没有正确更新。扩大与

的允许连接

service.service.connections.allowFromAnyIpv4(Port.allTraffic())

解决了。还需要弄清楚需要设置哪个最小集而不是allTrafic()

此外，我将 HttpIntegration 中的 localhost 替换为负载均衡器的端点，如下所示：

resource.addMethod("ANY", new HttpIntegration(
    'http://' + service.loadBalancer.loadBalancerDnsName, 
    {
        httpMethod: 'ANY',
        options: {
            connectionType: ConnectionType.VPC_LINK,
            vpcLink: new VpcLink(this, 'MyVpcLink', {
                targets: [service.loadBalancer],
                vpcLinkName: 'MyVpcLink',
            })
        },
    }
))

"Execution failed" 使用 AWS CDK 设置 API Gateway 和 Fargate 时

"Execution failed" when setting up API Gateway and Fargate with AWS CDK

aws-fargate

aws-load-balancer

aws-cdk