VPC:
PublicSubnet:
EC2-Instance
IGW
NAT
Route to IGW
PrivateSubnet:
EC2-Instance
Route to NAT
Route to S3VPCEndpoint
S3VPCEndpoint
这是我的 CFn 模板的网络部分:
Resources:
VPC:
Type: AWS::EC2::VPC
Properties:
EnableDnsSupport: true
EnableDnsHostnames: true
InstanceTenancy: default
CidrBlock: 10.1.0.0/16
PublicSubnet:
Type: AWS::EC2::Subnet
Properties:
CidrBlock: 10.1.0.0/24
MapPublicIpOnLaunch: True
VpcId: !Ref VPC
Tags:
- Key: "Name"
Value: "Raffael Public Subnet"
PrivateSubnet:
Type: AWS::EC2::Subnet
Properties:
CidrBlock: 10.1.1.0/24
VpcId: !Ref VPC
Tags:
- Key: "Name"
Value: "Raffael Private Subnet"
InternetGateway:
Type: AWS::EC2::InternetGateway
DependsOn: VPC
AttachGateway:
Type: AWS::EC2::VPCGatewayAttachment
Properties:
VpcId: !Ref VPC
InternetGatewayId: !Ref InternetGateway
PublicRouteTable:
Type: AWS::EC2::RouteTable
Properties:
VpcId: !Ref VPC
PrivateRouteTable:
Type: AWS::EC2::RouteTable
Properties:
VpcId: !Ref VPC
PublicRouteToIGW:
Type: AWS::EC2::Route
DependsOn: AttachGateway
Properties:
RouteTableId: !Ref PublicRouteTable
DestinationCidrBlock: 0.0.0.0/0
GatewayId: !Ref InternetGateway
PublicSubnetRouteTableAssociation:
Type: AWS::EC2::SubnetRouteTableAssociation
Properties:
SubnetId:
Ref: PublicSubnet
RouteTableId:
Ref: PublicRouteTable
PrivateSubnetRouteTableAssociation:
Type: AWS::EC2::SubnetRouteTableAssociation
Properties:
SubnetId:
Ref: PrivateSubnet
RouteTableId:
Ref: PrivateRouteTable
PublicInstanceSecurityGroup:
Type: AWS::EC2::SecurityGroup
Properties:
GroupDescription: Enable SSH access via port 22
VpcId: !Ref VPC
SecurityGroupIngress:
- IpProtocol: tcp
FromPort: 22
ToPort: 22
CidrIp: 0.0.0.0/0
PrivateInstanceSecurityGroup:
Type: AWS::EC2::SecurityGroup
Properties:
GroupDescription: Enable SSH access via port 22
VpcId: !Ref VPC
SecurityGroupIngress:
- IpProtocol: tcp
FromPort: 22
ToPort: 22
SourceSecurityGroupId: !GetAtt PublicInstanceSecurityGroup.GroupId
Nat:
Type: AWS::EC2::NatGateway
Properties:
AllocationId: !GetAtt NatEIP.AllocationId
SubnetId: !Ref PublicSubnet
NatEIP:
Type: AWS::EC2::EIP
Properties:
Domain: vpc
PrivateRouteToNat:
Type: AWS::EC2::Route
Properties:
RouteTableId: !Ref PrivateRouteTable
DestinationCidrBlock: 0.0.0.0/0
NatGatewayId: !Ref Nat
S3GatewayEndpoint:
Type: AWS::EC2::VPCEndpoint
Properties:
RouteTableIds:
- !Ref PublicRouteTable
- !Ref PrivateRouteTable
ServiceName: !Sub com.amazonaws.${AWS::Region}.s3
VpcId: !Ref VPC
有两个 EC2 实例 - 一个位于私有(private)子网中,一个位于公共(public)子网中。这些和相关的安全组是在第二个模板中设置的。
如果我通过公共(public) EC2 SSH 到私有(private) EC2,我可以从私有(private)子网访问 S3。含义 aws s3 ls
列出所有存储桶。
但是 - 这个请求显然是通过 NAT 进行的。因为如果我通过将其路由的 DestinationCidrBlock
设置为 1.2.3.4/32
来有效地停用它,那么 aws s3 ls
就会超时:
HTTPSConnectionPool(host='s3.amazonaws.com', port=443):
Max retries exceeded with url: / (Caused by ConnectTimeoutError
(<botocore.awsrequest.AWSHTTPSConnection object at 0x7fd86b183828>,
'Connection to s3.amazonaws.com timed out. (connect timeout=60)'))
所以我看了一下Why can’t I connect to an S3 bucket using a gateway VPC endpoint? :
- 您的 VPC 中的 DNS 设置:VPC 的“DNS 解析”设置为“已启用”
- 到 Amazon S3 的路由表设置:有一条路由
- 安全组出站规则:无限制
- 网络 ACL 规则:无限制
- 网关 VPC 端点策略:无限制
- S3 存储桶策略:我正在使用
ListBucket
进行测试
知道我必须在模板中调整什么吗?
最佳答案
您的 VPC 设置正确(减去缺少 DependsOn
)。我使用复制粘贴来复制您的设置,启动了两个实例,一个是公共(public)的,一个是私有(private)的,一切都按预期进行。
我还删除了 NAT 网关,并且 s3 访问仍然在私有(private)子网中工作。为了仔细检查,我删除了 S3 VPC 网关,对 s3 的访问停止了,表明流量正在通过网关。
因此,一定发生了其他事情,与 VPC 设置无关。也许与你的实例有关?不过,我使用了 us-east-1
区域,因此 eu-central-1
中可能存在一些区域问题?
关于amazon-web-services - 为什么通过网关端点与 S3 的连接超时?,我们在Stack Overflow上找到一个类似的问题: https://stackoverflow.com/questions/61785338/