ECS Fargate部署遇ALB 503，容器镜像拉取超时求助

我尝试使用Terraform部署ECS Fargate服务，但应用负载均衡器（ALB）的公网DNS返回503 Service Temporarily Unavailable，任务始终无法启动，健康状态未知，且CloudWatch中没有任何日志。

编辑1：任务停止原因如下：

无法拉取容器错误：拉取镜像清单已重试5次：解析镜像引用public.ecr.aws/aws-containers/ecsdemo-frontend:latest失败：请求执行失败：Head "https://public.ecr.aws/v2/aws-containers/ecsdemo-frontend/manifests/latest"：拨号tcp 99.83.145.10:443：I/O超时

编辑2：我已为ECS任务执行角色添加额外权限，但镜像拉取仍然失败：

resource "aws_iam_role_policy_attachment" "task_exec_ecs" {
  role       = "${module.ecs_service.task_exec_iam_role_name}"
  policy_arn = "arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy"
}

架构配置 #

公网ALB -> 部署在私有子网中的ECS Fargate服务，每个可用区（AZ）配置一个NAT网关，已创建必要的VPC终端节点。

ECS配置 #

module "ecs_service" {
  source = "terraform-aws-modules/ecs/aws//modules/service"

  name = var.ecs_service_name
  cluster_arn = module.ecs_cluster.arn

  runtime_platform = {
    operating_system_family = "LINUX"
    cpu_architecture        = "X86_64"
  }

  cpu    = 1024
  memory = 4096

  # 容器定义
  container_definitions = {

    ecs-sample = {
      cpu       = 512
      memory    = 1024
      essential = true
      image     = "public.ecr.aws/aws-containers/ecsdemo-frontend:latest"
      port_mappings = [
        {
          name          = var.ecs_service_name
          containerPort = var.ecs_service_port
          hostPort      = var.ecs_service_port
          protocol      = "tcp"
        }
      ]
    }
  }

  subnet_ids = module.vpc.private_subnets
  security_group_ids = [module.ecs-container-sg.security_group_id]

  autoscaling_min_capacity = 1
  autoscaling_max_capacity = 5
  
  load_balancer = {
    service = {
      target_group_arn = element(module.alb.target_group_arns, 0)
      container_name   = var.ecs_service_name
      container_port   = var.ecs_service_port
    }
  } 

  create_security_group = false

  depends_on = [
   module.ecs-container-sg,
   module.alb
 ]
}

vars.tf #

ecs_service_name = "ecs-sample" 
ecs_service_port = 3000

ALB配置 #

module "alb" {
  source  = "terraform-aws-modules/alb/aws"
  version = "~> 8.0"

  name = "${var.project_name}-alb"

  load_balancer_type = "application"

  vpc_id          = module.vpc.vpc_id
  subnets         = module.vpc.public_subnets
  security_groups = [module.alb-webtraffic-sg.security_group_id]

  http_tcp_listeners = [
    {
      port               = 80
      protocol           = "HTTP"
      target_group_index = 0
    }
  ]

 target_groups = [
    {
      name                       = "${var.ecs_service_name}-blue-tg"
      backend_protocol                  = "HTTP"
      backend_port                      = var.ecs_service_port
      target_type                       = "ip"
      deregistration_delay              = 10
      load_balancing_cross_zone_enabled = false
      health_check = {
        enabled             = true
        interval            = 5
        path                = "/"
        port                = var.ecs_service_port
        healthy_threshold   = 2
        unhealthy_threshold = 3
        timeout             = 3
        protocol            = "HTTP"
        matcher             = "200"
      }
    }
  ]

} 

安全组配置 #

module "alb-webtraffic-sg" {
  source  = "terraform-aws-modules/security-group/aws"
  version = "~> 4.0"

  name        = "${var.project_name}-alb-webtraffic-sg"
  description = "允许来自任意地址的80和443端口入站流量"
  vpc_id      = module.vpc.vpc_id

  ingress_cidr_blocks = ["0.0.0.0/0"]
  ingress_rules       = ["http-80-tcp", "https-443-tcp"]
  egress_rules        = ["all-all"]

  tags = {
    Name = "${var.project_name}-sg-webtraffic"
  }
}

module "ecs-container-sg" {
  source  = "terraform-aws-modules/security-group/aws"
  version = "~> 4.0"

  name        = "${var.project_name}-ecs-container-sg"
  description = "允许来自ALB安全组的入站流量"
  vpc_id      = module.vpc.vpc_id

  ingress_with_source_security_group_id = [
    {
      description              = "允许来自ALB安全组的入站流量"
      rule                     = "all-tcp"
      source_security_group_id = module.alb-webtraffic-sg.security_group_id
    }
  ]

  tags = {
    Name = "${var.project_name}-sg-webtraffic"
  }
}

module "vpc-sg" {
  source  = "terraform-aws-modules/security-group/aws"
  version = "~> 4.0"

  name        = "vpc-sg"
  description = "允许VPC内部的所有流量"
  vpc_id      = module.vpc.vpc_id

  ingress_cidr_blocks = [var.main_vpc_prefix]
  ingress_rules       = ["all-all"]
  egress_rules        = ["all-all"]

  tags = {
    Name = "${var.project_name}-vpc-sg"
  }
}

VPC终端节点配置 #

module "endpoints" {
  source = "terraform-aws-modules/vpc/aws//modules/vpc-endpoints"

  vpc_id             = module.vpc.vpc_id
  security_group_ids = [module.vpc-sg.security_group_id]

  endpoints = {
    dynamodb = {
      service         = "dynamodb",
      service_type    = "Gateway"
      route_table_ids = module.vpc.private_route_table_ids
      tags            = { Name = "dynamodb-vpc-endpoint" }
    },
    s3 = {
      service         = "s3",
      service_type    = "Gateway"
      route_table_ids = module.vpc.private_route_table_ids
      tags            = { Name = "s3-vpc-endpoint" }
    },
    ecr = {
      # 接口终端节点
      service_name        = "com.amazonaws.${data.aws_region.current.name}.ecr.api"
      subnet_ids          = module.vpc.private_subnets
      private_dns_enabled = true
      tags                = { Name = "logs-vpc-endpoint" }
    },
    dkr = {
      # 接口终端节点
      service_name        = "com.amazonaws.${data.aws_region.current.name}.ecr.dkr"
      subnet_ids          = module.vpc.private_subnets
      private_dns_enabled = true
      tags                = { Name = "logs-vpc-endpoint" }
    },
    logs = {
      # 接口终端节点
      service_name        = "com.amazonaws.${data.aws_region.current.name}.logs"
      subnet_ids          = module.vpc.private_subnets
      private_dns_enabled = true
      tags                = { Name = "logs-vpc-endpoint" }
    }
  }
}

VPC配置 #

module "vpc" {
  source = "terraform-aws-modules/vpc/aws"

  name = var.main_vpc_name
  cidr = var.main_vpc_prefix

  azs                 = var.availability_zones
  private_subnets     = var.private_subnets
  public_subnets      = var.public_subnets
  database_subnets    = var.database_subnets
  elasticache_subnets = var.elasticache_subnets

  enable_nat_gateway     = true
  single_nat_gateway     = false
  one_nat_gateway_per_az = true


  enable_vpn_gateway   = false
  enable_dns_support   = true
  enable_dns_hostnames = true

  create_database_subnet_group           = true
  create_database_subnet_route_table     = true
  create_database_internet_gateway_route = true
}

内容的提问来源于stack exchange，提问作者user2650277