ECS无法从ECR拉取镜像？求正确network.tf配置方案

报错信息：

ResourceInitializationError: unable to pull secrets or registry auth: execution resource retrieval failed: unable to retrieve ecr registry auth: service call has been retried 3 time(s): RequestError: send request failed caused by: Post "https://api.ecr.ap-southeast-1.amazonaws.com/": dial tcp xx.xxx.xxx.xxx:443: i/o timeout. Please check your task network configuration.

当前network.tf配置：

resource "aws_security_group" "myProject" {
  name   = "${terraform.workspace}-myProject"
  vpc_id = var.vpc_id
}

resource "aws_security_group" "openSearch" {
  name   = "${terraform.workspace}-opensearch"
  vpc_id = var.vpc_id
}

# ssh
resource "aws_security_group_rule" "ssh_ingress" {
  security_group_id = aws_security_group.myProject.id
  type              = "ingress"
  from_port         = 22
  to_port           = 22
  protocol          = "tcp"
  cidr_blocks       = ["0.0.0.0/0"]
}

# OpenSearch
resource "aws_security_group_rule" "myProject_ingress_opensearch" {
  type                     = "ingress"
  from_port                = 443 
  to_port                  = 443
  protocol                 = "tcp"
  security_group_id        = aws_security_group.myProject.id
  source_security_group_id = aws_security_group.opensearch.id
}

# 
resource "aws_security_group_rule" "myProject_egress" {
  type              = "egress"
  from_port         = 443
  to_port           = 443
  protocol          = "tcp"
  cidr_blocks       = ["0.0.0.0/0"]
  security_group_id = aws_security_group.myProject.id
}

作为Terraform和AWS新手，请问是否遗漏了配置？该如何编写正确的network.tf？

问题根源 #

你的安全组出站规则配置过于严格，只允许TCP 443端口的出站流量，但ECS拉取ECR镜像需要两个关键网络能力：

• DNS解析（UDP 53端口）：用于解析ECR API端点的域名
• HTTPS访问（TCP 443）：用于连接ECR API和拉取镜像

当前配置缺少DNS解析的出站权限，导致ECS任务无法解析api.ecr.ap-southeast-1.amazonaws.com的IP地址，最终触发超时错误。

修改后的network.tf配置 #

resource "aws_security_group" "myProject" {
  name   = "${terraform.workspace}-myProject"
  vpc_id = var.vpc_id
}

resource "aws_security_group" "openSearch" {
  name   = "${terraform.workspace}-opensearch"
  vpc_id = var.vpc_id
}

# SSH 入站规则
resource "aws_security_group_rule" "ssh_ingress" {
  security_group_id = aws_security_group.myProject.id
  type              = "ingress"
  from_port         = 22
  to_port           = 22
  protocol          = "tcp"
  cidr_blocks       = ["0.0.0.0/0"]
}

# OpenSearch 入站规则
resource "aws_security_group_rule" "myProject_ingress_opensearch" {
  type                     = "ingress"
  from_port                = 443 
  to_port                  = 443
  protocol                 = "tcp"
  security_group_id        = aws_security_group.myProject.id
  source_security_group_id = aws_security_group.opensearch.id
}

# 允许DNS解析的出站规则（UDP 53）
resource "aws_security_group_rule" "myProject_egress_dns" {
  type              = "egress"
  from_port         = 53
  to_port           = 53
  protocol          = "udp"
  cidr_blocks       = ["0.0.0.0/0"]
  security_group_id = aws_security_group.myProject.id
}

# 允许HTTPS的出站规则（TCP 443）
resource "aws_security_group_rule" "myProject_egress_https" {
  type              = "egress"
  from_port         = 443
  to_port           = 443
  protocol          = "tcp"
  cidr_blocks       = ["0.0.0.0/0"]
  security_group_id = aws_security_group.myProject.id
}

额外优化建议 #

1. 限制DNS规则的CIDR：如果你的VPC使用AWS默认DNS（通常是VPC网段的第二个IP，比如10.0.0.2），可以把DNS出站规则的cidr_blocks改成该地址，缩小权限范围提升安全性。
2. 使用ECR VPC端点：如果ECS任务部署在私有子网，建议创建ECR的VPC端点，这样无需通过公网访问ECR，同时可将出站规则的cidr_blocks限制为VPC端点地址，进一步优化网络安全。

内容的提问来源于stack exchange，提问作者Doraemon