AWS ECS负载均衡器运行一段时间后返回503状态码排查

我是一名后端服务开发者，DevOps（尤其是Terraform）经验不足。目前遇到的问题是：通过Github Actions将服务部署到AWS ECR和ECS后，初期API可以正常访问（健康检查路径及其他端点均返回200），但运行一段时间后，负载均衡器开始返回503状态码。

以下是我的Terraform配置详情：

VPC配置 #

resource "aws_default_vpc" "aws-vpc" {
  enable_dns_hostnames = true
  enable_dns_support   = true
  tags = {
    Name        = "${var.app_name}-vpc"
    Environment = var.APP_ENVIRONMENT
  }
}

ECR与ECS集群配置 #

resource "aws_ecr_repository" "aws-ecr" {
  name = "${var.upmentorship}-${var.APP_ENVIRONMENT}-ecr"
  tags = {
    Name        = "${var.upmentorship}-ecr"
    Environment = var.APP_ENVIRONMENT
  }
}

resource "aws_ecs_cluster" "aws-ecs-cluster" {
  name = "${var.upmentorship}-${var.APP_ENVIRONMENT}-cluster"
  tags = {
    Name        = "${var.upmentorship}-ecs"
    Environment = var.APP_ENVIRONMENT
  }
}

ECS服务配置 #

resource "aws_ecs_service" "aws-ecs-core-api" {
  name                 = "${var.core-api}-ecs"
  cluster              = aws_ecs_cluster.aws-ecs-cluster.id
  task_definition      = aws_ecs_task_definition.aws-ecs-core-api-task.arn //"${aws_ecs_task_definition.aws-ecs-core-service-task.family}:${max(aws_ecs_task_definition.aws-ecs-core-service-task.revision, data.aws_ecs_task_definition.core-service.revision)}"
  launch_type          = "FARGATE"
  scheduling_strategy  = "REPLICA"
  desired_count        = 2
  force_new_deployment = true

  deployment_circuit_breaker {
    enable = true
    rollback = true
  }

  network_configuration {
    subnets          = aws_default_subnet.default_private.*.id
    assign_public_ip = true
    security_groups = [
      aws_security_group.service_security_group.id,
      aws_security_group.load_balancer_security_group.id
    ]
  }

  load_balancer {
    target_group_arn = aws_lb_target_group.target_group.arn
    container_name   = "${var.core-api}-${var.APP_ENVIRONMENT}-container"
    container_port   = 8080
  }

  depends_on = [aws_lb_listener.listener]
}

ECS任务定义配置 #

resource "aws_ecs_task_definition" "aws-ecs-core-api-task" {
  family = "${var.core-api}-task"
  execution_role_arn       = aws_iam_role.ecsTaskExecutionRole.arn
  network_mode             = "awsvpc"
  requires_compatibilities = ["FARGATE"]
  cpu                      = "2048"
  memory                   = "8192"
  task_role_arn            = aws_iam_role.ecsTaskExecutionRole.arn
  #  container_definitions = jsonencode([local.task_definition_containers])
  container_definitions = <<DEFINITION
  [
    {
      "name": "${var.core-api}-${var.APP_ENVIRONMENT}-container",
      "image": "${aws_ecr_repository.aws-ecr.repository_url}:latest",
      "entryPoint": [],
      "environment": ${data.template_file.env_vars.rendered},
      "essential": true,
      "logConfiguration": {
        "logDriver": "awslogs",
        "options": {
          "awslogs-group": "${aws_cloudwatch_log_group.log-group.id}",
          "awslogs-region": "${var.AWS_REGION}",
          "awslogs-stream-prefix": "${var.core-api}-${var.APP_ENVIRONMENT}"
        }
      },
      "portMappings": [
        {
          "containerPort": 8080,
          "hostPort": 8080
        }
      ],
      "cpu": 1024,
      "memory": 4096,
      "memory_reservation": 8192,
      "networkMode": "awsvpc"
    }
  ]
DEFINITION
  tags = {
    name        = "${var.core-api}-ecs-td"
    environment = var.APP_ENVIRONMENT
  }
}

服务安全组配置 #

resource "aws_security_group" "service_security_group" {
  vpc_id = aws_default_vpc.aws-vpc.id

  ingress {
    from_port       = 0
    to_port         = 0
    protocol        = "-1"
    security_groups = [aws_security_group.load_balancer_security_group.id]
  }

  egress {
    from_port        = 0
    to_port          = 0
    protocol         = "-1"
    cidr_blocks      = ["0.0.0.0/0"]
    ipv6_cidr_blocks = ["::/0"]
  }

  tags = {
    Name        = "${var.core-api}-service-sg"
    Environment = var.APP_ENVIRONMENT
  }
}

负载均衡器配置 #

resource "aws_alb" "application_load_balancer" {
  name               = "${var.core-api}-${var.APP_ENVIRONMENT}-alb"
  internal           = false
  load_balancer_type = "application"
  subnets            = aws_default_subnet.default_public.*.id
  security_groups    = [aws_security_group.load_balancer_security_group.id]

  tags = {
    Name        = "${var.core-api}-alb"
    Environment = var.APP_ENVIRONMENT
  }
}

负载均衡器安全组配置 #

resource "aws_security_group" "load_balancer_security_group" {
  vpc_id = aws_default_vpc.aws-vpc.id

  ingress {
    from_port        = 80
    to_port          = 80
    protocol         = "tcp"
    cidr_blocks      = ["0.0.0.0/0"]
    ipv6_cidr_blocks = ["::/0"]
  }

  egress {
    from_port        = 0
    to_port          = 0
    protocol         = "-1"
    cidr_blocks      = ["0.0.0.0/0"]
    ipv6_cidr_blocks = ["::/0"]
  }
  tags = {
    Name        = "${var.core-api}-sg"
    Environment = var.APP_ENVIRONMENT
  }
}

负载均衡器目标组配置 #

resource "aws_lb_target_group" "target_group" {
  name        = "${var.core-api}-${var.APP_ENVIRONMENT}-tg"
  port        = 80
  protocol    = "HTTP"
  target_type = "ip"
  vpc_id      = aws_default_vpc.aws-vpc.id

  health_check {
    healthy_threshold   = "3"
    interval            = "30"
    protocol            = "HTTP"
    matcher             = "200,301,302"//"200"
    timeout             = "10"
    path                = "/debug/liveness"
    unhealthy_threshold = "10"
  }

  tags = {
    Name        = "${var.core-api}-lb-tg"
    Environment = var.APP_ENVIRONMENT
  }
}

负载均衡器监听器配置 #

resource "aws_lb_listener" "listener" {
  load_balancer_arn = aws_alb.application_load_balancer.id
  port              = "80"
  protocol          = "HTTP"

  default_action {
    type             = "forward"
    target_group_arn = aws_lb_target_group.target_group.id
  }
}

自动扩缩容配置 #

resource "aws_appautoscaling_target" "ecs_target" {
  max_capacity       = 2
  min_capacity       = 1
  resource_id        = "service/${aws_ecs_cluster.aws-ecs-cluster.name}/${aws_ecs_service.aws-ecs-core-api.name}"
  scalable_dimension = "ecs:service:DesiredCount"
  service_namespace  = "ecs"
}
resource "aws_appautoscaling_policy" "ecs_policy_memory" {
  name               = "${var.core-api}-${var.APP_ENVIRONMENT}-memory-autoscaling"
  policy_type        = "TargetTrackingScaling"
  resource_id        = aws_appautoscaling_target.ecs_target.resource_id
  scalable_dimension = aws_appautoscaling_target.ecs_target.scalable_dimension
  service_namespace  = aws_appautoscaling_target.ecs_target.service_namespace

  target_tracking_scaling_policy_configuration {
    predefined_metric_specification {
      predefined_metric_type = "ECSServiceAverageMemoryUtilization"
    }

    target_value = 80
  }
}

resource "aws_appautoscaling_policy" "ecs_policy_cpu" {
  name               = "${var.core-api}-${var.APP_ENVIRONMENT}-cpu-autoscaling"
  policy_type        = "TargetTrackingScaling"
  resource_id        = aws_appautoscaling_target.ecs_target.resource_id
  scalable_dimension = aws_appautoscaling_target.ecs_target.scalable_dimension
  service_namespace  = aws_appautoscaling_target.ecs_target.service_namespace

  target_tracking_scaling_policy_configuration {
    predefined_metric_specification {
      predefined_metric_type = "ECSServiceAverageCPUUtilization"
    }

    target_value = 80
  }
}

更新：
任务日志显示存在任务终止或重启事件，具体事件详情提示与资源限制相关的问题（如内存或CPU超出分配的配额）。

请问我的Terraform配置中可能存在什么问题？

内容的提问来源于stack exchange，提问作者shosho