如何在ECS中使用AWS Nitro Enclave？CloudFormation启动模板配置求助

核心逻辑说明 #

ECS服务的launchType: EC2本身不直接控制实例启动参数，Nitro Enclave的支持需要在EC2启动模板中配置，再通过ECS集群的自动扩缩容组（ASG）使用该模板，确保集群内的容器实例具备Enclave运行能力。

CloudFormation完整模板示例 #

1. 支持Nitro Enclave的EC2启动模板 #

Resources:
  NitroEnclaveLaunchTemplate:
    Type: AWS::EC2::LaunchTemplate
    Properties:
      LaunchTemplateName: ECS-Nitro-Enclave-Template
      LaunchTemplateData:
        InstanceType: m5.large  # 必须选用支持Nitro Enclave的实例类型（如m5/c5系列）
        ImageId: !Ref ECSOptimizedAmiId  # 对应区域的ECS优化AMI，需包含Nitro组件
        SecurityGroupIds:
          - !Ref ECSSecurityGroup
        IamInstanceProfile:
          Name: !Ref ECSInstanceProfile
        MetadataOptions:
          HttpTokens: required  # 推荐启用IMDSv2，符合Nitro Enclave安全规范
        EnclaveOptions:
          Enabled: true  # *关键配置：开启实例级Nitro Enclave支持*
        UserData:
          Fn::Base64: !Sub |
            #!/bin/bash
            echo ECS_CLUSTER=${ECSClusterName} >> /etc/ecs/ecs.config
            echo ECS_ENABLE_TASK_IAM_ROLE=true >> /etc/ecs/ecs.config
            echo ECS_ENABLE_TASK_IAM_ROLE_NETWORK_HOST=true >> /etc/ecs/ecs.config

2. ECS集群与自动扩缩容组 #

将启动模板关联到ECS集群，确保集群实例均支持Enclave：

ECSCluster:
    Type: AWS::ECS::Cluster
    Properties:
      ClusterName: Nitro-Enclave-ECS-Cluster

  ECSAutoScalingGroup:
    Type: AWS::AutoScaling::AutoScalingGroup
    Properties:
      VPCZoneIdentifier: !Ref SubnetIds
      LaunchTemplate:
        LaunchTemplateId: !Ref NitroEnclaveLaunchTemplate
        Version: !GetAtt NitroEnclaveLaunchTemplate.LatestVersionNumber
      MinSize: 1
      MaxSize: 3
      DesiredCapacity: 1
    CreationPolicy:
      ResourceSignal:
        Timeout: PT15M
    UpdatePolicy:
      AutoScalingRollingUpdate:
        MinInstancesInService: 1
        MaxBatchSize: 1
        PauseTime: PT15M
        WaitOnResourceSignals: true

  # ECS实例所需IAM角色
  ECSInstanceRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service: ec2.amazonaws.com
            Action: sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceforEC2Role

  ECSInstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      Roles:
        - !Ref ECSInstanceRole

3. 带Enclave配置的ECS任务定义与服务 #

NitroEnclaveTaskDefinition:
    Type: AWS::ECS::TaskDefinition
    Properties:
      Family: nitro-enclave-task
      NetworkMode: host  # Nitro Enclave仅支持host或awsvpc网络模式
      RequiresCompatibilities:
        - EC2
      ExecutionRoleArn: !Ref ECSExecutionRole
      TaskRoleArn: !Ref ECSTaskRole
      ContainerDefinitions:
        - Name: enclave-enabled-container
          Image: your-enclave-image:latest
          Essential: true
          EnclaveOptions:
            Enabled: true  # 开启容器级Enclave支持
          # 补充端口映射、环境变量等自定义配置

  ECSService:
    Type: AWS::ECS::Service
    Properties:
      Cluster: !Ref ECSCluster
      ServiceName: Nitro-Enclave-ECS-Service
      TaskDefinition: !Ref NitroEnclaveTaskDefinition
      LaunchType: EC2
      DesiredCount: 1

关键注意事项 #

• 实例类型限制：必须选用官方支持Nitro Enclave的实例系列（如m5/m5a、c5/c5a、z1d等），避免使用不兼容类型。
• AMI选择：使用对应区域的ECS优化AMI，确保预装Nitro Enclave相关驱动与工具。
• 网络模式限制：任务定义仅支持host或awsvpc模式，bridge模式无法启用Enclave。
• 权限配置：确保ECS实例角色、任务角色具备访问ECS、Enclave相关资源的必要权限。

内容的提问来源于stack exchange，提问作者John Smith