配置ALB后EC2无法访问的技术求助

我有一台运行Docker容器的EC2实例，用于提供静态Web应用服务。原本域名直接指向EC2时，80端口可正常访问，但配置ALB负责SSL终止后，域名完全无法访问。期望的流程是：域名请求转发到ALB，ALB处理HTTPS连接，再通过HTTP 80端口转发到EC2。以下是我的Terraform配置：

DNS.tf #

resource "aws_route53_zone" "main" {
  name = var.domain_name
}

resource "aws_route53_record" "www" {
  zone_id = aws_route53_zone.main.zone_id
  name    = "www.${var.domain_name}"
  type    = "A"
 // ttl     = "300"
 // records = [aws_lb.resume-app-application-load-balancer.dns_name]
  depends_on = [aws_lb.resume-app-application-load-balancer]

    alias {
    name                   = aws_lb.resume-app-application-load-balancer.dns_name
    zone_id                = aws_lb.resume-app-application-load-balancer.zone_id
    evaluate_target_health = true
  }
}

resource "aws_route53_record" "root" {
  zone_id = aws_route53_zone.main.zone_id
  name    = var.domain_name
  type    = "A"
 // ttl     = "300"
 // records = [aws_lb.resume-app-application-load-balancer.dns_name]
  depends_on = [aws_lb.resume-app-application-load-balancer]

    alias {
    name                   = aws_lb.resume-app-application-load-balancer.dns_name
    zone_id                = aws_lb.resume-app-application-load-balancer.zone_id
    evaluate_target_health = true
  }
}

resource "aws_route53_record" "example" {
  for_each = {
    for dvo in aws_acm_certificate.resume-app-cert.domain_validation_options : dvo.domain_name => {
      name   = dvo.resource_record_name
      record = dvo.resource_record_value
      type   = dvo.resource_record_type
    }
  }

  allow_overwrite = true
  name            = each.value.name
  records         = [each.value.record]
  ttl             = 60
  type            = each.value.type
  zone_id         = aws_route53_zone.main.zone_id
}

ALB.tf #

resource "aws_lb" "resume-app-application-load-balancer" {
  name               = var.resume-app-application-load-balancer-name
  internal           = false
  load_balancer_type = "application"
  subnets            = [aws_subnet.resume-app-public-subnet.id, aws_subnet.resume-app-public-subnet2.id] # 2 subnets minimum

  depends_on = [aws_acm_certificate_validation.resume-app-cert]
}

ALB_LISTENER.tf #

# Create a listener on port 443 for HTTPS traffic
resource "aws_lb_listener" "resume-app-application-load-balancer-listener" {
  load_balancer_arn = aws_lb.resume-app-application-load-balancer.arn
  port              = 443
  protocol          = "HTTPS"
  
  ssl_policy        = "ELBSecurityPolicy-2016-08"
  certificate_arn   = aws_acm_certificate.resume-app-cert.arn
  
  default_action {
    target_group_arn = aws_lb_target_group.resume-app-application-load-balancer-target-group.arn
    type             = "forward"
  }

  depends_on = [aws_acm_certificate_validation.resume-app-cert]
}

ALB_TARGET_GROUP.tf #

resource "aws_lb_target_group" "resume-app-application-load-balancer-target-group" {
  name     = var.resume-app-application-load-balancer-target-group-name
  port     = 80 # Port on which EC2 instance listens
  protocol = "HTTP"
  vpc_id   = aws_vpc.resume-app-vpc.id

  health_check {
    path                = "/"
    port                = 80
    protocol            = "HTTP"
    interval            = 30
    timeout             = 10
    healthy_threshold   = 2
    unhealthy_threshold = 2
  }
}

ACM + ACM VALIDATION.tf #

resource "aws_acm_certificate" "resume-app-cert" {
  domain_name       = var.domain_name
  validation_method = "DNS"

  tags = {
    Name = "resume-app-ssl-cert"
  }
}

resource "aws_acm_certificate_validation" "resume-app-cert" {
  certificate_arn         = aws_acm_certificate.resume-app-cert.arn
  validation_record_fqdns = [for record in aws_route53_record.example : record.fqdn]
}

SECURITY_GROUP.tf #

resource "aws_security_group" "resume-app-security-group" {
  name        = var.security_group_name
  description = "Allow HTTP and HTTPS traffic for inbound and outbound connections to the web app."
  vpc_id      = aws_vpc.resume-app-vpc.id

  ingress {
    from_port   = 80
    to_port     = 80
    protocol    = "tcp"
    cidr_blocks = var.cidr_ingress_80
  }

  ingress {
    from_port   = 443
    to_port     = 443
    protocol    = "tcp"
    cidr_blocks = var.cidr_ingress_443
  }

  ingress {
    from_port   = 22
    to_port     = 22
    protocol    = "tcp"
    cidr_blocks = var.cidr_ingress_22
  }

  ingress {
    from_port   = -1
    to_port     = -1
    protocol    = "icmp"
    cidr_blocks = var.cidr_ingress_icmp
  }

  egress {
    from_port   = 0
    to_port     = 0
    protocol    = var.cidr_egress_protocol
    cidr_blocks = var.cidr_egress_ips
  }
}

排查与修复建议 #

1. 目标组未关联EC2实例 #

你的aws_lb_target_group仅定义了规则，但没有将EC2实例添加到目标组中，ALB无法识别后端服务地址。需要添加实例关联资源：

resource "aws_lb_target_group_attachment" "resume-app-ec2-attachment" {
  target_group_arn = aws_lb_target_group.resume-app-application-load-balancer-target-group.arn
  target_id        = aws_instance.your-ec2-resource.id # 替换为你的EC2实例资源ID
  port             = 80
}

2. 缺失HTTP端口监听 #

当前ALB仅配置了443端口的HTTPS监听，没有处理80端口的HTTP请求。用户直接用HTTP访问域名会失败，建议添加HTTP到HTTPS的重定向监听：

resource "aws_lb_listener" "resume-app-http-redirect" {
  load_balancer_arn = aws_lb.resume-app-application-load-balancer.arn
  port              = "80"
  protocol          = "HTTP"

  default_action {
    type = "redirect"
    redirect {
      port        = "443"
      protocol    = "HTTPS"
      status_code = "HTTP_301"
    }
  }
}

3. 安全组需允许ALB访问EC2的80端口 #

确认EC2实例已绑定resume-app-security-group，且该安全组的80端口 ingress规则允许ALB所在VPC的子网IP段访问。如果var.cidr_ingress_80设置为0.0.0.0/0则没问题，否则需添加ALB子网的CIDR。

4. 检查目标组健康状态 #

Route53别名记录开启了evaluate_target_health = true，若目标组中EC2实例健康检查失败，Route53会停止解析域名到ALB。需验证：

• EC2上的Docker容器正常运行，80端口映射正确
• 健康检查路径/返回200状态码
• EC2安全组允许ALB的健康检查流量（默认来自VPC内部IP）

5. 确认ACM证书已完成验证 #

登录AWS ACM控制台，检查证书状态是否为已颁发。若DNS验证未完成，ALB的HTTPS监听无法正常工作，导致HTTPS访问失败。可通过Route53控制台确认验证记录是否正确生效。

内容的提问来源于stack exchange，提问作者Assaf