Search code examples
amazon-web-servicesamazon-vpcamazon-app-runner

How to access the Internet from an AWS App Runner service that is added to a VPC?

The question is the same as this one but has screenshots of AWS resources' configurations.

Situation:

  • A backend is hosted as an App Runner service.
  • The backend needs to communicate with a private RDS instance. So, the App Runner service is add to a VPC.
  • Backend can now communicate with the RDS instance.

Expected:

  • Backend should also be able to make HTTP requests to the Internet.

Actual:

  • Any HTTP request from the backend to the Internet takes forever/times out.

Checklist:

  • An Internet gateway is connected.
  • Route table is set to route 0.0.0.0/0 to the Internet gateway.
  • Security group allows outbound access.

I've tried also putting a NAT gateway in place of the Internet gateway and set up the route table accordingly. But the behaviour was the same. Screenshots below are without the NAT gateway configuration.

Screenshots:

VPC Connector configuration on App Runner service

enter image description here

Security group outbound rule allowing all traffic

enter image description here

Route table routing outbound traffic to internet gateway

enter image description here

Route table association with all subnets (non-explicit. Default, didn't change)

enter image description here

How I know that my service has no outbound Internet access:

  • I'm making a request google.com
  • I've made a log before, after, and in catch of the request.
  • Log happens before, but then nothing happens. And my API that invokes this request keeps loading forever (until it Gateway Timeouts after 5 minutes). enter image description here

So, what is wrong in my configuration above/How can I give outbound Internet access to the service?
And btw, I can access the service itself (i.e., inbound traffic) through the domain generated by App Runner.

A related discussion: https://github.com/aws/apprunner-roadmap/issues/109

Solution

  • According to the official App Runner documentation, you must use a NAT Gateway to provide Internet access to App Runner applications running in a VPC.

    You mentioned you already tried to use a NAT Gateway in your question, but I think you configured it incorrectly. Please bear in mind the following:

    • Your VPC needs both public and private subnets configured in order to properly use a NAT Gateway. Public subnets are subnets that have a route to the Internet Gateway. Private subnets are subnets that have a route to the NAT Gateway.
    • The NAT Gateway itself must reside in a public subnet.
    • The App Runner application must be configured to run only in private subnets.