amazon-web-services - 带有到私有(private) ALB 的自定义链接的 AWS HTTP API 网关

Question

我有以下设置
自定义域 api.foo.co.uk -> API 映射到阶段 v1 -> HTTP API 路径 ANY /{proxy+} -> 私有(private) VPC链接 -> ALB Fargate
如果我点击自定义域 api.foo.co.uk我得到一个 503 "message": "Service Unavailable"如果我直接点击 API p3dqjsdfszlv7.execute-api.eu-west-1.amazonaws.com/v1/我也一样
在 API 的 CW 中，我看到以下内容:

{
"auth_status":"-",
"aws_endpoint":"-",
"cognito_auth_provider":"-",
"cognito_auth_type":"-",
"cognito_identity_id":"-",
"cognito_identity_pool_id":"-",
"domain_name":"api.foo.co.uk",
"domain_prefix":"api",
"err_msg":"Service Unavailable",
"err_response":"INTEGRATION_NETWORK_FAILURE",
"err_string":" "Service Unavailable"",
"http_method":"GET",
"integration_error":"-",
"integration_error_msg":"-",
"integration_int_status":"200",
"integration_status":"-",
"path":"/v1/",
"principa_ord_id":"-",
"protocol":"HTTP/1.1",
"request_id":"cSJJ2h7BjoEEJ-g=",
"route_key":"ANY /{proxy+}",
"source_ip":"22.22.103.68",
"stage":"v1",
"status":"503",
"time":"16/Mar/2021:14:08:24 +0000",
"user":"-",
"user_agent":"insomnia/2021.1.0"}

任何人都知道问题可能是什么？我查看了错误消息 err_response":"INTEGRATION_NETWORK_FAILURE" 中找不到任何内容或者可能是什么原因。
我还启用了 ALB 上的访问日志，但它们是空白的，所以我假设它没有达到 ALB

Answer 1

我有同样的问题 INTEGRATION_NETWORK_FAILURE .通过包含所有 $context.integration*，我设法找到了一条信息更丰富的错误消息。访问日志中的变量(请参阅 https://docs.aws.amazon.com/apigateway/latest/developerguide/http-api-logging-variables.html )。在我的情况下，有一条错误消息说“由于与端点通信的网络错误，请求失败”。
我不知道确切的原因是什么或者是什么让它消失了，但我可以分享一些最终工作设置的 CloudFormation 片段:

ALB 设置 - 监听端口 80 上的 HTTP 请求:

  ApplicationLoadBalancerSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: !Sub "${EnvironmentName} ALB security group"
      GroupName: !Sub "${EnvironmentName}-load-balancer-sg"
      VpcId:
        'Fn::ImportValue': !Sub "${EnvironmentName}:VPC"
      SecurityGroupIngress:
        - CidrIp: "0.0.0.0/0"
          IpProtocol: "tcp"
          FromPort: 80
          ToPort: 80
      SecurityGroupEgress:
        - CidrIp: "0.0.0.0/0"
          IpProtocol: "-1"

  SharedApplicationLoadBalancer:
    Type: AWS::ElasticLoadBalancingV2::LoadBalancer
    Properties:
      Name: !Sub "${EnvironmentName}-shared-lb"
      Scheme: "internal"
      Type: "application"
      Subnets:
        - 'Fn::ImportValue': !Sub "${EnvironmentName}:${LBSubnetType}1"
        - 'Fn::ImportValue': !Sub "${EnvironmentName}:${LBSubnetType}2"
      SecurityGroups:
        - !Ref ApplicationLoadBalancerSecurityGroup
      IpAddressType: "ipv4"

  SharedApplicationLoadBalancerListener:
    Type: AWS::ElasticLoadBalancingV2::Listener
    DependsOn:
      - SharedApplicationLoadBalancer
    Properties:
      LoadBalancerArn: !Ref SharedApplicationLoadBalancer
      Protocol: "HTTP"
      Port: 80
      DefaultActions:
        - Type: fixed-response
          FixedResponseConfig:
            StatusCode: 404
            MessageBody: Shared ALB has no such route
            ContentType: text/plain

每服务 ALB 目标组:

  SharedAlbServiceXTargetGroup:
    Type: "AWS::ElasticLoadBalancingV2::TargetGroup"
    Properties:
      Name: !Sub "${EnvironmentName}-alb-${ServiceName}-tg"
      HealthCheckIntervalSeconds: 30
      HealthCheckPath: "/ping"
      HealthCheckProtocol: "HTTP"
      HealthyThresholdCount: 2
      Port: 8080
      Protocol: "HTTP"
      UnhealthyThresholdCount: 2
      VpcId:
        "Fn::ImportValue": !Sub "${EnvironmentName}:VPC"
      TargetType: "ip"

  SharedAlbServiceXListenerRule:
    Type: "AWS::ElasticLoadBalancingV2::ListenerRule"
    Properties:
      Actions:
        - Type: "forward"
          TargetGroupArn: !Ref SharedAlbServiceXTargetGroup
      Conditions:
        - Field: "host-header"
          HostHeaderConfig:
            Values:
              - !Ref HttpApiCustomDomain
      ListenerArn: !Ref SharedApplicationLoadBalancerListener
      Priority: !Ref SharedAlbListenerRulePriority

VPC链接:

  PrivateApiGatewayVpcLinkSecurityGroup:
    Condition: PrivateAccess
    Type: "AWS::EC2::SecurityGroup"
    Properties:
      VpcId:
        'Fn::ImportValue': !Sub "${EnvironmentName}:VPC"
      GroupName: !Sub "${EnvironmentName}-apigw-vpclink"
      GroupDescription: !Sub "SG for API Gateway private VPC link in ${EnvironmentName} environment"
      SecurityGroupIngress:
      - IpProtocol: tcp
        FromPort: 80
        ToPort: 80
        CidrIp: 0.0.0.0/0

  PrivateApiGatewayVpcLink:
    Condition: PrivateAccess
    Type: "AWS::ApiGatewayV2::VpcLink"
    Properties:
      Name: !Sub "${EnvironmentName}-api-gateway-vpclink"
      SecurityGroupIds:
        - !Ref PrivateApiGatewayVpcLinkSecurityGroup
      SubnetIds:
        - "Fn::ImportValue": !Sub "${EnvironmentName}:PrivateSubnet1"
        - "Fn::ImportValue": !Sub "${EnvironmentName}:PrivateSubnet2"

API网关集成

  HttpApiIntegration:
    Type: "AWS::ApiGatewayV2::Integration"
    Properties:
      ApiId: !Ref HttpApi
      Description: !Sub "Private ALB Integration for ${ServiceName} in ${EnvironmentName} env"
      IntegrationType: "HTTP_PROXY"
      IntegrationMethod: "ANY"
      ConnectionType: "VPC_LINK"
      ConnectionId: !Ref PrivateApiGatewayVpcLink
      IntegrationUri: !Ref SharedApplicationLoadBalancerListener
      PayloadFormatVersion: "1.0"