NestJS微服务部署AWS Elastic Beanstalk遇TCP连接超时问题求助

问题背景 #

将NestJS微服务和API网关部署到AWS Elastic Beanstalk后，API网关无法连接微服务，返回504网关超时，控制台无报错信息。本地环境下该架构运行正常，已配置网络负载均衡器接收5000端口的TCP连接。

相关代码与配置 #

微服务代码与配置 #

main.ts

import { ConfigService } from '@nestjs/config'
import { NestFactory } from '@nestjs/core'
import { MicroserviceOptions, Transport } from '@nestjs/microservices'
import { FastifyAdapter, NestFastifyApplication } from '@nestjs/platform-fastify'

import { AppModule } from './app.module'
import { AllExceptionsFilter } from './filters/rpc-exception.filter'

async function bootstrap() {
  const app = await NestFactory.create<NestFastifyApplication>(
    AppModule,
    new FastifyAdapter({ logger: true })
  )

  app.enableCors()

  const config = app.get<ConfigService>(ConfigService)

  app.connectMicroservice<MicroserviceOptions>({ transport: Transport.TCP, options: {
    host: '0.0.0.0',
    port: +config.get('TCP_PORT', 5000) || 5000
  } })

  app.useGlobalFilters(new AllExceptionsFilter())

  await app.startAllMicroservices()
  await app.listen(config.get('PORT', 3000) || 3000, '0.0.0.0')
}

bootstrap()

Dockerfile（微服务）

...

###################
# PRODUCTION
###################
FROM node:18-alpine As production

ARG NODE_ENV=production

ARG MONGODB_URI=
ARG MONGODBADMIN_URI=

ARG PORT=8080
ARG TCP_PORT=5000

ENV NODE_ENV=${NODE_ENV}
ENV MONGODB_URI=${MONGODB_URI}
ENV MONGODBADMIN_URI=${MONGODBADMIN_URI}
ENV PORT=${PORT}
ENV TCP_PORT=${TCP_PORT}

COPY --chown=node:node --from=build /usr/src/app/node_modules ./node_modules
COPY --chown=node:node --from=build /usr/src/app/dist ./dist

EXPOSE 8080 5000

ENTRYPOINT [ "node", "dist/main" ]

API网关代码与配置 #

mymodule.module.ts

import { Module } from '@nestjs/common'
import { ConfigService } from '@nestjs/config'
import { ClientsModule, Transport } from '@nestjs/microservices'

import { MyModuleController } from './mymodule.controller'
import { MyModuleService } from './mymodule.service'

@Module({
  imports: [
    ClientsModule.registerAsync([
      {
        name: 'MY_SERVICE',
        useFactory: (configService: ConfigService) => ({
          transport: Transport.TCP,
          options: {
            host: configService.get('MY_SERVICE_HOST'),
            port: configService.get('MY_SERVICE_PORT')
          }
        }),
        inject: [ConfigService]
      }
    ])
  ],
  controllers: [MyModuleController],
  providers: [MyModuleService]
})
export class MyModule {}

Dockerfile（API网关）

...

###################
# PRODUCTION
###################
FROM node:18-alpine As production

ARG NODE_ENV=production

ARG MY_SERVICE_HOST=my-service.eu-central-1.elasticbeanstalk.com
ARG MY_SERVICE_PORT=5000

ARG PORT=8080

ARG JWT_SECRET=

ENV NODE_ENV=${NODE_ENV}
ENV MY_SERVICE_HOST=${MY_SERVICE_HOST}
ENV MY_SERVICE_PORT=${MY_SERVICE_PORT}
ENV PORT=${PORT}
ENV JWT_SECRET=${JWT_SECRET}

COPY --chown=node:node --from=build /usr/src/app/node_modules ./node_modules
COPY --chown=node:node --from=build /usr/src/app/dist ./dist

EXPOSE 8080

ENTRYPOINT [ "node", "dist/main" ]

微服务网络负载均衡器配置 #

排查与解决方案 #

1. 验证安全组规则 #

• 微服务所在EC2实例的安全组需允许5000端口的TCP入站流量，来源为API网关所在环境的安全组或EB环境的IP范围
• 网络负载均衡器的安全组需允许5000端口的TCP入站（来自API网关）和出站（到微服务EC2）流量

2. 检查负载均衡器目标组健康状态 #

• 确认目标组中微服务EC2实例的5000端口健康检查通过：
  • 健康检查协议设为TCP，端口5000
  • 若实例状态不健康，登录EC2执行netstat -tulpn | grep 5000，验证微服务是否正常监听5000端口

3. 确认微服务TCP服务启动状态 #

• 登录微服务EC2实例，查看应用日志确认TCP微服务启动状态：

  docker logs <容器ID>
  

  需确认日志中存在类似Nest microservice successfully started的启动信息

4. 测试API网关到微服务的连通性 #

• 在API网关EC2实例内执行命令测试5000端口连通性：

  telnet my-service.eu-central-1.elasticbeanstalk.com 5000
  # 或
  nc -zv my-service.eu-central-1.elasticbeanstalk.com 5000
  

  若连接失败，需回溯安全组、NACL等网络配置是否存在阻断

5. 检查EB环境端口映射配置 #

• Elastic Beanstalk使用Docker部署时，需确认Dockerrun.aws.json中正确映射5000端口：

  {
    "AWSEBDockerrunVersion": "1",
    "Ports": [
      {
        "ContainerPort": 5000,
        "HostPort": 5000
      },
      {
        "ContainerPort": 8080,
        "HostPort": 8080
      }
    ]
  }
  

  缺少该配置会导致EC2主机无法将5000端口暴露给负载均衡器

6. 验证环境变量配置 #

• 确认微服务环境中TCP_PORT变量确实设置为5000，可在EB控制台查看环境变量列表，或在实例内执行echo $TCP_PORT验证

内容的提问来源于stack exchange，提问作者AuroPick