无法访问AWS EC2实例：SSH及8080端口连接超时求助

错误信息 #

SSH连接错误 #

ssh: connect to host *ip here* port 22: Connection timed out

HTTP访问错误 #

Unable to connect
Firefox can't establish a connection to the server at *ip*:8080

配置文件与脚本 #

main.tf #

provider "aws" {
    region = "eu-west-3"
}

variable vpc_cidr_block {}
variable subnet_cidr_block {}
variable avail_zone {}
variable env_prefix {}
variable my_ip {}
variable instance_type {}
variable public_key_location {}

resource "aws_vpc" "myapp-vpc" {
  cidr_block = var.vpc_cidr_block
  tags = {
    Name = "${var.env_prefix}-vpc"
  }
}

resource "aws_subnet" "myapp-subnet-1" {
  vpc_id = aws_vpc.myapp-vpc.id
  cidr_block = var.subnet_cidr_block
  availability_zone = var.avail_zone
  tags = {
    Name = "${var.env_prefix}-subnet-1"
  }
}

resource "aws_internet_gateway" "myapp-igw" {
  vpc_id = aws_vpc.myapp-vpc.id
  tags = {
    Name = "${var.env_prefix}-igw"
  }
}

resource "aws_default_route_table" "main-rtb" {
  default_route_table_id = aws_vpc.myapp-vpc.default_route_table_id

  route {
    cidr_block = "0.0.0.0/0"
    gateway_id = aws_internet_gateway.myapp-igw.id
  }
  tags = {
    Name = "${var.env_prefix}-main-rtb"
  }
}

resource "aws_default_security_group" "default-sg" {
  vpc_id = aws_vpc.myapp-vpc.id

  ingress {
    from_port   = 22
    to_port     = 22
    protocol    = "tcp"
    cidr_blocks = [var.my_ip]
  }

  ingress {
    from_port   = 8080
    to_port     = 8080
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  egress {
    from_port       = 0
    to_port         = 0
    protocol        = "-1"
    cidr_blocks     = ["0.0.0.0/0"]
    prefix_list_ids = []
  }

  tags = {
    Name = "${var.env_prefix}-default-sg"
  }
}

data "aws_ami" "latest-amazon-linux-image" {
  most_recent = true
  owners = ["amazon"]
  filter {
    name = "name"
    values = ["amzn2-ami-hvm-*-x86_64-gp2"]
  }
  filter {
    name = "virtualization-type"
    values = ["hvm"]
  }
}

output "aws_ami_id" {
  value = data.aws_ami.latest-amazon-linux-image.id
}

output "ec2_public_ip" {
  value = aws_instance.myapp-server.public_ip
}

resource "aws_key_pair" "ssh-key" {
  key_name = "server-key"
  public_key = file(var.public_key_location)
}

resource "aws_instance" "myapp-server" {
  ami                         = data.aws_ami.latest-amazon-linux-image.id
  instance_type               = var.instance_type
  subnet_id                   = aws_subnet.myapp-subnet-1.id
  vpc_security_group_ids      = [aws_default_security_group.default-sg.id]
  availability_zone           = var.avail_zone
  associate_public_ip_address = true
  key_name = aws_key_pair.ssh-key.key_name

  user_data = file("entry-script.sh")

  tags = {
        Name = "${var.env_prefix}-server"
  }
}

entry-script.sh #

#!/bin/bash
sudo yum update -y && sudo yum install -y docker
sudo systemctl start docker
sudo usermod -aG docker ec2-user
docker run -p 8080:80 nginx

当前配置的资源规则 #

安全组入站规则 #

Name Security group rule ID IP version Type Protocol Port range Source Description
–   sgr-0bcbda1a7b9d6e6a8   IPv4    SSH TCP 22  *myIpHere*/32   –
–   sgr-02ebfb5a794a8bd17   IPv4    Custom TCP  TCP 8080    0.0.0.0/0   –

子网路由表 #

Destination Target
10.0.0.0/16 local
0.0.0.0/0   igw-0c111019740d3621b

网络ACL入站规则 #

Rule number Type Protocol Port range Source Allow/Deny
100         HTTP* (8080)    TCP (6) 8080    0.0.0.0/0   Allow
*       All traffic All     All             0.0.0.0/0   Deny

已尝试的操作 #

• 反复检查main.tf、AWS配置及官方文档
• 重新生成SSH密钥对
• 检查本地防火墙设置
• 销毁并重新部署所有资源5次以上
• 更换其他设备尝试访问

问题诊断与解决方案 #

核心问题：网络ACL规则缺失 #

你的怀疑是正确的，问题出在网络ACL配置。AWS网络ACL是无状态的，默认的*规则会拒绝所有未被显式允许的流量，且入站、出站流量需要分别配置：

1. 你未添加SSH（22端口）的入站允许规则，导致SSH连接被拦截
2. 未配置必要的出站规则，即使入站允许，实例的响应流量也会被拒绝

修复步骤 #

1. 补充网络ACL入站规则

在AWS控制台的网络ACL入站规则中添加：

• 规则号：110（优先级需低于默认的*规则）
• 类型：SSH（22）
• 协议：TCP（6）
• 端口范围：22
• 来源：你的公网IP/32
• 动作：允许

2. 配置网络ACL出站规则

添加两条出站允许规则：

• 规则号100：允许TCP协议0-65535端口，目标0.0.0.0/0（覆盖所有响应流量）
• 规则号110：允许所有ICMP流量（可选，用于测试网络连通性）

3. 验证子网关联

确认EC2实例所在子网已关联修改后的网络ACL（默认VPC子网会关联默认ACL，自定义VPC需手动关联）

4. 额外验证点

• 检查EC2实例系统日志，确认user_data脚本是否成功执行（Docker、Nginx是否启动）
• 确认实例公网IP已正确分配（Terraform配置中associate_public_ip_address = true已设置）

Terraform代码修复（可选） #

如果希望通过代码管理网络ACL，可添加以下资源：

# 创建自定义网络ACL
resource "aws_network_acl" "myapp-nacl" {
  vpc_id = aws_vpc.myapp-vpc.id
  tags = { Name = "${var.env_prefix}-nacl" }
}

# 入站允许SSH
resource "aws_network_acl_rule" "nacl-ssh-ingress" {
  network_acl_id = aws_network_acl.myapp-nacl.id
  rule_number    = 100
  egress         = false
  protocol       = "tcp"
  rule_action    = "allow"
  cidr_block     = var.my_ip
  from_port      = 22
  to_port        = 22
}

# 入站允许8080
resource "aws_network_acl_rule" "nacl-8080-ingress" {
  network_acl_id = aws_network_acl.myapp-nacl.id
  rule_number    = 110
  egress         = false
  protocol       = "tcp"
  rule_action    = "allow"
  cidr_block     = "0.0.0.0/0"
  from_port      = 8080
  to_port        = 8080
}

# 出站允许所有TCP响应
resource "aws_network_acl_rule" "nacl-tcp-egress" {
  network_acl_id = aws_network_acl.myapp-nacl.id
  rule_number    = 100
  egress         = true
  protocol       = "tcp"
  rule_action    = "allow"
  cidr_block     = "0.0.0.0/0"
  from_port      = 0
  to_port        = 65535
}

# 子网关联自定义ACL
resource "aws_subnet_network_acl_association" "myapp-subnet-nacl" {
  subnet_id      = aws_subnet.myapp-subnet-1.id
  network_acl_id = aws_network_acl.myapp-nacl.id
}

内容的提问来源于stack exchange，提问作者odxrs