为何ECS/EC2上MongoDB连接超时，本地与ECS/Fargate却正常？

问题背景 #

在ECS上将Spring Boot应用从Fargate迁移至EC2模式后，出现MongoDB连接超时问题。本地及Fargate环境下连接均正常，报错为MongoSocketOpenException，根因是连接MongoDB副本集节点超时。

更新记录

• 更新1：已补充完整堆栈跟踪
• 更新2：ECS使用awsvpc网络模式

报错信息 #

com.mongodb.MongoSocketOpenException: Exception opening socket
    at com.mongodb.internal.connection.SocketStream.open(SocketStream.java:73) ~[mongodb-driver-core-4.8.2.jar!/:na]
    at com.mongodb.internal.connection.InternalStreamConnection.open(InternalStreamConnection.java:183) ~[mongodb-driver-core-4.8.2.jar!/:na]
    at com.mongodb.internal.connection.DefaultServerMonitor$ServerMonitorRunnable.lookupServerDescription(DefaultServerMonitor.java:198) ~[mongodb-driver-core-4.8.2.jar!/:na]
    at com.mongodb.internal.connection.DefaultServerMonitor$ServerMonitorRunnable.run(DefaultServerMonitor.java:158) ~[mongodb-driver-core-4.8.2.jar!/:na]
    at java.base/java.lang.Thread.run(Thread.java:833) ~[na:na]
Caused by: java.net.SocketTimeoutException: Connect timed out
    at java.base/sun.nio.ch.NioSocketImpl.timedFinishConnect(NioSocketImpl.java:546) ~[na:na]
    at java.base/sun.nio.ch.NioSocketImpl.connect(NioSocketImpl.java:597) ~[na:na]
    at java.base/java.net.SocksSocketImpl.connect(SocksSocketImpl.java:327) ~[na:na]
    at java.base/java.net.Socket.connect(Socket.java:633) ~[na:na]
    at java.base/sun.security.ssl.SSLSocketImpl.connect(SSLSocketImpl.java:299) ~[na:na]
    at com.mongodb.internal.connection.SocketStreamHelper.initialize(SocketStreamHelper.java:107) ~[mongodb-driver-core-4.8.2.jar!/:na]
    at com.mongodb.internal.connection.SocketStream.initializeSocket(SocketStream.java:82) ~[mongodb-driver-core-4.8.2.jar!/:na]
    at com.mongodb.internal.connection.SocketStream.open(SocketStream.java:68) ~[mongodb-driver-core-4.8.2.jar!/:na]
    ... 4 common frames omitted

Root Issue:

2024-03-03T22:19:48.746Z  INFO 6 --- [nio-8080-exec-3] org.mongodb.driver.cluster               : No server chosen by com.mongodb.client.internal.MongoClientDelegate$1@66b65db6 from cluster description ClusterDescription{type=REPLICA_SET, connectionMode=MULTIPLE, serverDescriptions=[ServerDescription{address=ac-kgxtec5-shard-00-00.fk3mwfb.mongodb.net:27017, type=UNKNOWN, state=CONNECTING, exception={com.mongodb.MongoSocketOpenException: Exception opening socket}, caused by {java.net.SocketTimeoutException: Connect timed out}}, ServerDescription{address=ac-kgxtec5-shard-00-01.fk3mwfb.mongodb.net:27017, type=UNKNOWN, state=CONNECTING, exception={com.mongodb.MongoSocketOpenException: Exception opening socket}, caused by {java.net.SocketTimeoutException: Connect timed out}}, ServerDescription{address=ac-kgxtec5-shard-00-02.fk3mwfb.mongodb.net:27017, type=UNKNOWN, state=CONNECTING, exception={com.mongodb.MongoSocketOpenException: Exception opening socket}, caused by {java.net.SocketTimeoutException: Connect timed out}}]}. Waiting for 30000 ms 

排查步骤 #

1. 网络ACL与安全组检查 #

• 确认EC2实例所在子网的网络ACL，入站/出站规则是否允许访问MongoDB副本集节点的27017端口（TCP）。
• 检查EC2实例的安全组，出站规则需放行到MongoDB节点的27017端口；若MongoDB为Atlas集群，需确认安全组已将EC2实例的公网IP/子网CIDR加入白名单。

2. 路由与NAT网关配置 #

• 使用awsvpc网络模式时，若EC2实例在私有子网，需确认NAT网关配置正常，私有子网路由表已指向NAT网关，确保实例能访问公网（MongoDB Atlas为公网地址时）。
• 在EC2实例内部执行telnet ac-kgxtec5-shard-00-00.fk3mwfb.mongodb.net 27017或nc -zv ac-kgxtec5-shard-00-00.fk3mwfb.mongodb.net 27017，验证端口连通性。

3. DNS解析验证 #

• 在EC2实例内执行nslookup ac-kgxtec5-shard-00-00.fk3mwfb.mongodb.net，确认能正确解析MongoDB节点的IP地址，避免DNS解析失败导致的连接超时。

4. MongoDB客户端配置检查 #

• 确认Spring Boot的MongoDB配置中，副本集地址、认证信息与Fargate环境一致，未出现配置错误。
• 尝试增加客户端连接超时时间（如spring.data.mongodb.connect-timeout=60000），排除因网络延迟导致的超时。

5. EC2实例网络性能排查 #

• 检查EC2实例的网络指标（如数据包丢失、延迟），可通过CloudWatch监控查看网络出入流量是否异常。
• 尝试在EC2实例内ping MongoDB节点IP，查看延迟与丢包情况。

内容的提问来源于stack exchange，提问作者Isfar Oshir