2

I've a small Fargate cluster with a service running and found that if I disable the public IP the container won't build as it doesn't have a route to pull the image.

The ELB for ECS Fargate is part of a subnet which has:

  1. internet gateway configured and attached
  2. route table allowing unrestricted outgoing
  3. security policy on the ECS service allows unrestricted outgoing
  4. DNS enabled

My understanding is the internet gateway is a NAT and the above actions should permit outgoing internet access however I can't make it so. What else is missing?

user18194743
  • 21
  • 3
  • "My understanding is the internet gateway is a NAT" That is not correct. An internet gateway is not a NAT. Resources have to have a public IP to use an internet gateway. Resources without a public IP have to use a NAT Gateway to access the internet. In AWS, an Internet Gateway and a NAT Gateway are two completely different things. – Mark B Feb 13 '22 at 22:54
  • Thank you, my knowledge is corrected. Unfortunately adding a NAT has not corrected the issue, without a public IP assigned to task it still can't pull the image. – user18194743 Feb 14 '22 at 10:18
  • Did you place the task in a private subnet (a subnet with a route to a NAT gateway instead of a route to an internet gateway)? Did you place the NAT gateway in a public subnet (a subnet with a route to an internet gateway)? – Mark B Feb 14 '22 at 12:59

1 Answers1

1

Just like all other resources in your AWS VPC, if you don't attach a public IP address, then it needs either to be placed in a subnet with a route to a NAT Gateway to access things outside the VPC, or it needs VPC endpoints to access those resources.

I have set-up a EBL for a persistent public & subnet IP. As far as I can tell my subnet has outgoing internet unrestricted (internet gateway attached and route opens up all outgoing traffic to 0.0.0.0/0. I'm unsure if the service setup will configure the EC2 to use this first then attempt to set-up the container. If not then it probably doesn't apply.

ELB is for inbound traffic only, it does not provide any sort of outbound networking functionality for your EC2 or Fargate instance. The ELB is not in any way involved when ECS tries to pull a container image.

Having a volatile public IP address is a bit annoying as my understanding is the security policy will apply to both the ELB/Elastic provided IP and this one.

What "security policy" are you referring to? I'm not aware of security policies on AWS that are applied directly to IP addresses. Assuming you mean the Security Group when you say "security policy", your understanding is incorrect. Both the EC2 or Fargate instance and the ELB should have different security groups assigned to them. The ELB would have a security group allowing all inbound traffic, if you want it to be public on the Internet. The EC2 or Fargate instance should have a security group only allowing inbound traffic from the ELB (by specifying the ELB's security group ID in the inbound rule).

I want to point out you say "EC2" in your question and never mention Fargate, but you tagged your question with Fargate twice and didn't tag it with EC2. EC2 and Fargate are separate compute services on AWS. You would either be using one or the other. It doesn't really matter in this case given the issue you are encountering, but it helps to be clear in your questions.

Mark B
  • 183,023
  • 24
  • 297
  • 295