如何通过Docker Compose将子域名绑定到AWS ECS后端服务？

通过Docker Compose在AWS ECS上部署后端服务（监听80端口），需要将Route53托管区下的子域名server.dev.example.com指向该服务。已完成子域名的ACM证书认证，并在托管区创建了CNAME记录，但部署后访问子域名出现curl: (6) Could not resolve host及浏览器DNS_PROBE_POSSIBLE错误。

原始docker-compose.yml配置：

version: "3.9"
services:
  backend-server:
    image: PATH_TO_ECR_URL
    ports:
      - "80:80" 

x-aws-cloudformation:
  Resources:
    BackendserverTCP80Listener:
      Properties:
        Certificates:
          - CertificateArn: "ARN_TO_CERTIFIED_SUBDOMAIN"
        Protocol: HTTPS
        Port: 443

部署后自动生成的CloudFormation核心模板：

AWSTemplateFormatVersion: 2010-09-09
Resources:
  CloudMap:
    Properties:
      Description: Service Map for Docker Compose project server
      Name: server.local
      Vpc: vpc-xxx
    Type: AWS::ServiceDiscovery::PrivateDnsNamespace
  Cluster:
    Properties:
      ClusterName: backend-server
      Tags:
        - Key: com.docker.compose.project
          Value: backend-server
    Type: AWS::ECS::Cluster
  Default80Ingress:
    Properties:
      CidrIp: 0.0.0.0/0
      Description: backend-server:80/tcp on default network
      FromPort: 80
      GroupId:
        Ref: DefaultNetwork
      IpProtocol: TCP
      ToPort: 80
    Type: AWS::EC2::SecurityGroupIngress
  DefaultNetwork:
    Properties:
      GroupDescription: backend-server Security Group for default network
      Tags:
        - Key: com.docker.compose.project
          Value: backend-server
        - Key: com.docker.compose.network
          Value: backend-server_default
      VpcId: vpc-xxx
    Type: AWS::EC2::SecurityGroup
  LoadBalancer:
    Properties:
      Scheme: internet-facing
      SecurityGroups:
        - Ref: DefaultNetwork
      Subnets:
        - subnet-xxx
        - subnet-xxx
        - subnet-xxx
        - subnet-xxx
        - subnet-xxx
        - subnet-xxx
      Tags:
        - Key: com.docker.compose.project
          Value: backend-server
      Type: application
    Type: AWS::ElasticLoadBalancingV2::LoadBalancer
  BackendserverTCP80Listener:
    Properties:
      DefaultActions:
        - ForwardConfig:
            TargetGroups:
              - TargetGroupArn:
                  Ref: BackendserverTCP80TargetGroup
          Type: forward
      LoadBalancerArn:
        Ref: LoadBalancer
      Port: 443
      Protocol: HTTPS
      Certificates:
        - CertificateArn: CERT_ARN
    Type: AWS::ElasticLoadBalancingV2::Listener

要实现仅通过docker-compose up完成子域名关联，需在docker-compose.yml的x-aws-cloudformation扩展中添加两项关键配置：自动创建Route53记录、放行443端口安全组规则，确保DNS解析和流量通路正常。

修改后的完整docker-compose.yml：

version: "3.9"
services:
  backend-server:
    image: PATH_TO_ECR_URL
    ports:
      - "80:80" 

x-aws-cloudformation:
  Resources:
    BackendserverTCP80Listener:
      Properties:
        Certificates:
          - CertificateArn: "ARN_TO_CERTIFIED_SUBDOMAIN"
        Protocol: HTTPS
        Port: 443
    # 添加443端口入站规则，允许外部HTTPS访问
    Default443Ingress:
      Type: AWS::EC2::SecurityGroupIngress
      Properties:
        CidrIp: 0.0.0.0/0
        Description: Allow HTTPS access to backend-server
        FromPort: 443
        GroupId: !Ref DefaultNetwork
        IpProtocol: TCP
        ToPort: 443
    # 自动创建Route53 CNAME记录，关联负载均衡公网DNS
    ServerSubdomainRecord:
      Type: AWS::Route53::RecordSet
      Properties:
        HostedZoneId: "YOUR_ROUTE53_HOSTED_ZONE_ID"  # 替换为你的托管区ID
        Name: "server.dev.example.com."  # 子域名末尾需加英文句号
        Type: CNAME
        TTL: 300
        ResourceRecords:
          - !GetAtt LoadBalancer.DNSName

关键说明： #

1. 自动关联DNS：通过AWS::Route53::RecordSet资源，直接将子域名指向部署生成的负载均衡公网DNS，避免手动配置的指向错误或生效延迟，需替换YOUR_ROUTE53_HOSTED_ZONE_ID为实际托管区ID。
2. 放行HTTPS端口：原配置仅开放80端口，而HTTPS监听使用443端口，必须添加入站规则允许外部访问，否则流量无法到达负载均衡。
3. 一键完成部署：修改后执行docker-compose up，Docker会自动将所有资源纳入CloudFormation栈，完成部署、DNS关联和端口放行的全流程，无需额外手动操作。

内容的提问来源于stack exchange，提问作者thank_you