无法从EC2实例通过443端口访问私有子网内的ECS服务

背景 #

我在私有子网中运行带有若干任务的ECS服务，同VPC的公有子网内有一台EC2实例，希望通过该EC2实例的443端口访问绑定特定域名的ECS服务，但始终无法连通。

测试结果 #

1. 扫描域名443端口 #

nmap -Pn <domain-name> -p443

Starting Nmap 6.40 ( http://nmap.org ) at 2023-05-24 20:35 UTC
Nmap scan report for <domain-name>
Host is up.
Other addresses for <domain-name>
PORT    STATE    SERVICE
443/tcp filtered https

Nmap done: 1 IP address (1 host up) scanned in 2.03 seconds

2. 扫描ECS任务私有IP的443端口 #

nmap -Pn <Private-IP> -p443

Starting Nmap 6.40 ( http://nmap.org ) at 2023-05-24 20:27 UTC
Host is up (0.00099s latency).
PORT    STATE  SERVICE
443/tcp closed https

Nmap done: 1 IP address (1 host up) scanned in 0.03 seconds

3. Ping连通性测试 #

• Ping目标域名：

ping <domain-name>

6 packets transmitted, 0 received, 100% packet loss, time 5106ms

• Ping ECS任务私有IP：

ping <private-IP>

4 packets transmitted, 4 received, 0% packet loss, time 3003ms

4. 扫描域名80端口 #

nmap -Pn -p80 <DNS>

PORT   STATE    SERVICE
80/tcp filtered http

Nmap done: 1 IP address (1 host up) scanned in 2.04 seconds

已完成的配置 #

安全组规则（Terraform配置） #

已配置ECS服务的入站安全组，允许来自公有子网EC2实例的流量，且控制台确认规则生效：

# 允许HTTPS入站
resource "aws_security_group_rule" "inbound_https" {
  security_group_id = aws_security_group.inbound.id
  type = "ingress"
  from_port = 443
  to_port = 443
  protocol = "tcp"
  cidr_blocks = ["<public-IP-cidr>"]
}

# 允许ICMP入站
resource "aws_security_group_rule" "inbound_icmp" {
  security_group_id = aws_security_group.inbound.id
  type = "ingress"
  from_port = 0
  to_port = 0
  protocol = "icmp"
  cidr_blocks = ["<public-IP-cidr>"]
}

# 额外开放HTTP入站
resource "aws_security_group_rule" "lcp_inbound_http" {
  security_group_id = aws_security_group.lcp_inbound.id
  type = "ingress"
  from_port = 80
  to_port = 80
  protocol = "tcp"
  cidr_blocks = ["<public-IP-cidr>"]
}

VPC网络ACL #

已确认VPC的NACL允许所有端口的所有流量进出。

ECS任务定义 #

{
    "taskDefinitionArn": "<TASK-DEF-ARN>",
    "containerDefinitions": [
        {
            "name": "<NAME>",
            "image": "<IMAGE>",
            "cpu": 1024,
            "memory": 2048,
            "portMappings": [
                {
                    "containerPort": 80,
                    "hostPort": 80,
                    "protocol": "tcp"
                }
            ],
            "essential": true,
            "mountPoints": [],
            "volumesFrom": [],
            "logConfiguration": {
                "logDriver": "awslogs",
                "options": {
                    "awslogs-group": "awslogs-group",
                    "awslogs-region": "us-east-1",
                    "awslogs-stream-prefix": "awslogs-stream-prefix"
                }
            }
        }
    ],
    "family": "<FAMILY>",
    "taskRoleArn": "<TASK-ROLE-ARN>",
    "executionRoleArn": "<EXECUTION-ROLE-ARN>",
    "networkMode": "awsvpc",
    "revision": 63,
    "volumes": [],
    "status": "ACTIVE",
    "requiresAttributes": [
        {
            "name": "com.amazonaws.ecs.capability.logging-driver.awslogs"
        },
        {
            "name": "ecs.capability.execution-role-awslogs"
        },
        {
            "name": "com.amazonaws.ecs.capability.ecr-auth"
        },
        {
            "name": "com.amazonaws.ecs.capability.docker-remote-api.1.19"
        },
        {
            "name": "com.amazonaws.ecs.capability.task-iam-role"
        },
        {
            "name": "ecs.capability.execution-role-ecr-pull"
        },
        {
            "name": "com.amazonaws.ecs.capability.docker-remote-api.1.18"
        },
        {
            "name": "ecs.capability.task-eni"
        }
    ],
    "placementConstraints": [],
    "compatibilities": [
        "EC2",
        "FARGATE"
    ],
    "requiresCompatibilities": [
        "FARGATE"
    ],
    "cpu": "1024",
    "memory": "2048",
    "registeredAt": "2023-05-24T21:25:20.965Z",
    "registeredBy": "<REGISTERED-BY>",
    "tags": [
        {
            "key": "Environment",
            "value": "dev"
        },
        {
            "key": "Region",
            "value": "us-east-1"
        },
        {
            "key": "Service",
            "value": "My Awesome Service"
        },
        {
            "key": "Stage",
            "value": "<STAGE>"
        }
    ]
}

疑问 #

已开放对应端口的入站安全组，NACL也无限制，但仍无法通过EC2实例访问ECS服务，请问还遗漏了哪些配置？

内容的提问来源于stack exchange，提问作者Somethingwhatever