Search code examples
amazon-web-servicesamazon-ecsaws-fargate

Docker instance running on private subnet AWS Fargate


My VPC consists of 2 public and 2 private subnets, private subnet having NAt gateway to access internet and my docker instance is running on private subnet which receives external URLs (http://commondatastorage.googleapis.com/gtv-videos-bucket/sample/BigBuckBunny.mp4) as input and download content/file and store the files in s3

I have application load balancer setup in public subnet and connects to fargate instance

when i try to run and the logs say NAME cannot be resolved commondatastorage.googleapis.com

I understand that docker is not having internet connection

What i am doing wrong here and what needs to corrected?

PS: While creating the fargate service I DISABLED Auto Assign Public IP as instance should be on private subnet


Solution

  • You probably already checked the AWS page about "Task Networking in AWS Fargate"

    The key to be able to reach internet is a NAT, so, if it's not working, you should start from that in checking for errors. You can see how important it is from the following description taken from the page I linked

    In this configuration, the tasks can still communicate to other servers on the internet via the NAT gateway. They would appear to have the IP address of the NAT gateway to the recipient of the communication. If you run a Fargate task in a private subnet, you must add this NAT gateway. Otherwise, Fargate can’t make a network request to Amazon ECR to download the container image, or communicate with Amazon CloudWatch to store container metrics.

    If the NAT for some reason is not working, another approach could be to ENABLE Auto Assign Public IP, but define a security group that blocks any attempt to connect to your tasks in the private VPC. In this way the Task will be able to reach the DNS server required to resolve commondatastorage.googleapis.com