如何为ECS Fargate负载均衡器绑定自定义安全组或集成CloudFront

一、为自动创建的负载均衡器绑定自定义安全组 #

Docker Compose部署ECS Fargate时，自动生成的Application Load Balancer可通过x-aws-cloudformation字段覆盖配置，添加自定义安全组。修改你的docker-compose.yml，在x-aws-cloudformation.Resources下新增ApplicationLoadBalancer配置：

services:
  application:
    image: 000.dkr.ecr.us-east-1.amazonaws.com/org/pos:latest
    platform: linux/amd64
    env_file: .env.${ENV}
    build:
      context: "."
    ports:
      - 80:80
    restart: always
    networks:
      - mail
      - app_network
  postfix:
    image: 000.dkr.ecr.us-east-1.amazonaws.com/org/postfix:latest
    platform: linux/amd64
    build:
      context: "postfix"
    container_name: postfix
    networks:
      - mail
      - app_network
    hostname: postfix
    restart: always
networks:
  app_network:
      name: tcetra_network
  mail:
    name: postfix-mail
x-aws-cloudformation:
  Resources:
    ApplicationLoadBalancer:
      Properties:
        SecurityGroups:
          - sg-0828b05baf4899773
    ApplicationTCP80Listener:
      Properties:
        Certificates:
          - CertificateArn: "arn:aws:acm:us-east-1:088048903606:certificate/d7a330ce-77d6-4753-bcf0-913f8ac0cee3"
        Protocol: HTTPS
        Port: 443
    ApplicationTCP80TargetGroup:
      Properties:
        HealthCheckPath: /health.html
        Matcher:
          HttpCode: 200-499

关键说明：

• ApplicationLoadBalancer是Docker Compose自动生成的负载均衡器资源固定名称，直接覆盖其SecurityGroups属性即可绑定指定安全组。
• 需确保自定义安全组sg-0828b05baf4899773已配置入站规则，放行来自CloudFront的流量（可使用AWS前缀列表com.amazonaws.global.cloudfront.origin-facing批量允许所有CloudFront源站IP）。

二、在Docker Compose中通过CloudFormation创建CloudFront分发 #

若需直接在配置中创建CloudFront分发，可在x-aws-cloudformation.Resources中添加CloudFrontDistribution资源，配置指向负载均衡器的源站、缓存规则等：

x-aws-cloudformation:
  Resources:
    ApplicationLoadBalancer:
      Properties:
        SecurityGroups:
          - sg-0828b05baf4899773
    ApplicationTCP80Listener:
      Properties:
        Certificates:
          - CertificateArn: "arn:aws:acm:us-east-1:088048903606:certificate/d7a330ce-77d6-4753-bcf0-913f8ac0cee3"
        Protocol: HTTPS
        Port: 443
    ApplicationTCP80TargetGroup:
      Properties:
        HealthCheckPath: /health.html
        Matcher:
          HttpCode: 200-499
    CloudFrontDistribution:
      Type: AWS::CloudFront::Distribution
      Properties:
        DistributionConfig:
          Enabled: true
          Origins:
            - Id: ECSALBOrigin
              DomainName: !GetAtt ApplicationLoadBalancer.DNSName
              CustomOriginConfig:
                HTTPPort: 80
                HTTPSPort: 443
                OriginProtocolPolicy: https-only
          DefaultCacheBehavior:
            TargetOriginId: ECSALBOrigin
            ViewerProtocolPolicy: redirect-to-https
            AllowedMethods:
              - GET
              - HEAD
              - OPTIONS
              - POST
              - PUT
              - PATCH
              - DELETE
            CachedMethods:
              - GET
              - HEAD
              - OPTIONS
            DefaultTTL: 3600
            ForwardedValues:
              QueryString: true
              Cookies:
                Forward: all
          ViewerCertificate:
            AcmCertificateArn: "arn:aws:acm:us-east-1:088048903606:certificate/d7a330ce-77d6-4753-bcf0-913f8ac0cee3"
            SslSupportMethod: sni-only
            MinimumProtocolVersion: TLSv1.2_2021

关键说明：

• 使用!GetAtt ApplicationLoadBalancer.DNSName自动引用负载均衡器的域名，无需手动填写。
• CloudFront要求关联的ACM证书必须部署在us-east-1区域，确保你的证书符合该要求。
• 可根据业务需求调整缓存行为、允许的HTTP方法、TTL等配置项。

内容的提问来源于stack exchange，提问作者Chris Muench