amazon-web-services - AWS Fargate : unable to pull secrets or registry auth

Question

我正在尝试在 aws fargate 上启动容器化 grpc 应用程序。我已经在本地测试了该图像，并将其推送到 ecr。我已经创建了一个具有访问 ecr 权限的角色的任务，但拉动容器时仍然出现错误(错误消息如下所示)。我什至尝试在具有互联网网关/路由表关联的公共(public)子网中启动容器，该关联会自动分配公共(public) IP，并且安全组允许所有出站流量。

完整的cloudformation模板如下:

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31

Resources:
  TicketingAppTaskDefinition:
    Type: AWS::ECS::TaskDefinition
    Properties:
      ContainerDefinitions:
        - Essential: true
          Image: !Sub "${AWS::AccountId}.dkr.ecr.${AWS::Region}.amazonaws.com/ticketing-app:latest"
          Name: ticketing-app
          PortMappings:
            - ContainerPort: 8080
      Cpu: "1 vCPU"
      ExecutionRoleArn: !Ref ExecutionRole
      Memory: "2 GB" #this is smallest for 1 vcpu .... could maybe decrease
      NetworkMode: awsvpc
      RuntimePlatform:
        CpuArchitecture: X86_64
        OperatingSystemFamily: LINUX
  ExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Action: [ sts:AssumeRole ]
            Effect: Allow
            Principal:
              Service: [ ecs-tasks.amazonaws.com ]
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy
  TicketingEcsService:
    Type: AWS::ECS::Service
    Properties:
      Cluster: !Ref TicketingEcsCluster
      LaunchType: FARGATE
  #TODO I think we eventually need to specify load balancers here
      NetworkConfiguration:
        AwsvpcConfiguration:
          AssignPublicIp: ENABLED #TODO remove this when done, just seeing if this let's us grab image from ecr?
          SecurityGroups: [ !GetAtt TicketingServiceSecurityGroup.GroupId ]
          Subnets:
            - !Ref TicketingServicePrivateSubnet01
            - !Ref TicketingServicePrivateSubnet02
      TaskDefinition: !Ref TicketingAppTaskDefinition
  TicketingEcsCluster:
    Type: AWS::ECS::Cluster
  TicketingServiceSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: "A security group used for the ticketing app"
      VpcId: !Ref TicketingServiceVpc
  TicketingServiceVpc:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: 10.0.0.0/16
  TicketingServicePrivateSubnet01:
    Type: AWS::EC2::Subnet
    Properties:
      AvailabilityZone: !Sub "${AWS::Region}a"
      VpcId: !Ref TicketingServiceVpc
      CidrBlock: 10.0.0.0/18
  TicketingServicePrivateSubnet02:
    Type: AWS::EC2::Subnet
    Properties:
      AvailabilityZone: !Sub "${AWS::Region}b"
      VpcId: !Ref TicketingServiceVpc
      CidrBlock: 10.0.64.0/18
#TODO public subnets and NAT gateway?
  TicketingSecurityGroupHttpIngress:
    Type: AWS::EC2::SecurityGroupIngress
    Properties:
  #TODO I would probably use load balancer security group name here once we make one instead of opening up to any ip
      GroupId: !GetAtt TicketingServiceSecurityGroup.GroupId
      CidrIpv6: "::/0"
      FromPort: 8080
      IpProtocol: tcp
      ToPort: 8080
  TicketingSecurityGroupAllTrafficEgress:
    Type: AWS::EC2::SecurityGroupEgress
    Properties:
      GroupId: !GetAtt TicketingServiceSecurityGroup.GroupId
      IpProtocol: "-1" #-1 indicates all -- like a wildcard
      CidrIp: "0.0.0.0/0"
  TicketingServiceInternetGateway:
    Type: AWS::EC2::InternetGateway
    DependsOn: TicketingServiceVpc
  AttachGateway:
    Type: AWS::EC2::VPCGatewayAttachment
    Properties:
      VpcId: !Ref TicketingServiceVpc
      InternetGatewayId: !Ref TicketingServiceInternetGateway
  TicketingAppRouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref TicketingServiceVpc
  TicketingVPCRouteAllTrafficToInternetGateway:
    Type: AWS::EC2::Route
    DependsOn: AttachGateway
    Properties:
      RouteTableId: !Ref TicketingAppRouteTable
      DestinationCidrBlock: "0.0.0.0/0"
      GatewayId: !Ref TicketingServiceInternetGateway

是否有人能够指出一种简单的方法来实现此功能(即使它没有使用最佳实践，例如公共(public)子网而不是私有(private)子网和 nat 网关)——它仅适用于 poc。

谢谢

Answer 1

我已将我的图像推送到不同区域的 ecr...更改了区域并且它起作用了(手掌)。

因此请检查您所在的地区是否有其他人与我处于同一位置。