Fargate 服务不尊重安全组

Question

当通过安全组限制其入口时，我无法从 Fargate 容器连接到 RDS 实例。不过我可以连接 lambdas。

容器在访问 SQS 或 Internet 时没有问题。只有到达 RDS 端点时出现问题。

这是模板的摘录，其中数据库入口是打开的。 Fargate 可以毫无问题地连接。

  Service:
    Type: AWS::ECS::Service
    Properties:
      ServiceName: !Ref ServiceName
      Cluster: !Ref Cluster
      TaskDefinition: !Ref TaskDefinition
      PlatformVersion: 1.3.0
      DeploymentConfiguration:
        MinimumHealthyPercent: 100
        MaximumPercent: 200
      DesiredCount: 0
      LaunchType: FARGATE
      NetworkConfiguration:
        AwsvpcConfiguration:
          AssignPublicIp: DISABLED
          Subnets:
            - !Ref PrivateSubnet1
          SecurityGroups:
            - !Ref DatabaseAccessSecurityGroup

  DatabaseInstance:
    Type: AWS::RDS::DBInstance
    Properties:
      Engine: mysql
      EngineVersion: 8.0.16
      AvailabilityZone: !GetAtt PrivateSubnet1.AvailabilityZone
      PubliclyAccessible: false
      ...
      VPCSecurityGroups:
        - !Ref DatabaseSecurityGroup

  DatabaseSubnetGroup:
    Type: AWS::RDS::DBSubnetGroup
    Properties:
      DBSubnetGroupDescription: Cloudformation managed Db subnet group
      SubnetIds:
        - !Ref PrivateSubnet1
        - !Ref PrivateSubnet2

  DatabaseSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      VpcId: !Ref VPC
      GroupName: database-sg
      GroupDescription: Database security group
      SecurityGroupIngress:
        - Description: Access to RDS
          # allowing all works with Fargate
          CidrIp: 0.0.0.0/0
          FromPort: 3306
          ToPort: 3306
          IpProtocol: tcp

  DatabaseAccessSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupName: database-access-sg
      GroupDescription: Security group for accessing db
      VpcId: !Ref VPC

但是，如果我将 DatabaseSecurityGroup 组入口更改为仅允许通过 DatabaseAccessSecurityGroup 入口，则在尝试通过 Fargate 连接时会出现错误。使用相同安全组的 Lambda 没有问题。

   SecurityGroupIngress:
     - Description: Access to RDS
       CidrIp: 0.0.0.0/0
       SourceSecurityGroupId: !GetAtt DatabaseAccessSecurityGroup.GroupId
       FromPort: 3306
       ToPort: 3306
       IpProtocol: tcp

有什么方法可以让 Fargate 服务遵守安全组规则吗？

Answer 1

出现此问题是因为我在 Cloudformation 模板中使用了 Service，但通过 ecs.runTask 启动了任务，这覆盖了 [=10] 中的安全组=].

Fargate 服务不尊重安全组

Fargate service not respecting security groups

amazon-web-services

aws-fargate