amazon-web-services - 为什么通过网关端点与 S3 的连接超时？

Question

VPC:
  PublicSubnet:
    EC2-Instance
    IGW
    NAT
    Route to IGW
  PrivateSubnet:
    EC2-Instance
    Route to NAT
    Route to S3VPCEndpoint
  S3VPCEndpoint

这是我的 CFn 模板的网络部分:

Resources:
  VPC:
    Type: AWS::EC2::VPC
    Properties:
      EnableDnsSupport: true
      EnableDnsHostnames: true
      InstanceTenancy: default
      CidrBlock: 10.1.0.0/16

  PublicSubnet:
    Type: AWS::EC2::Subnet
    Properties:
      CidrBlock: 10.1.0.0/24
      MapPublicIpOnLaunch: True
      VpcId: !Ref VPC
      Tags:
        - Key: "Name"
          Value: "Raffael Public Subnet"

  PrivateSubnet:
    Type: AWS::EC2::Subnet
    Properties:
      CidrBlock: 10.1.1.0/24
      VpcId: !Ref VPC
      Tags:
        - Key: "Name"
          Value: "Raffael Private Subnet"

  InternetGateway:
    Type: AWS::EC2::InternetGateway
    DependsOn: VPC

  AttachGateway:
    Type: AWS::EC2::VPCGatewayAttachment
    Properties:
      VpcId: !Ref VPC
      InternetGatewayId: !Ref InternetGateway

  PublicRouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref VPC

  PrivateRouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref VPC

  PublicRouteToIGW:
    Type: AWS::EC2::Route
    DependsOn: AttachGateway
    Properties:
      RouteTableId: !Ref PublicRouteTable
      DestinationCidrBlock: 0.0.0.0/0
      GatewayId: !Ref InternetGateway

  PublicSubnetRouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId:
        Ref: PublicSubnet
      RouteTableId:
        Ref: PublicRouteTable

  PrivateSubnetRouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId:
        Ref: PrivateSubnet
      RouteTableId:
        Ref: PrivateRouteTable

  PublicInstanceSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Enable SSH access via port 22
      VpcId: !Ref VPC
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 22
          ToPort: 22
          CidrIp: 0.0.0.0/0

  PrivateInstanceSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Enable SSH access via port 22
      VpcId: !Ref VPC
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 22
          ToPort: 22
          SourceSecurityGroupId: !GetAtt PublicInstanceSecurityGroup.GroupId

  Nat:
     Type: AWS::EC2::NatGateway
     Properties:
        AllocationId: !GetAtt NatEIP.AllocationId
        SubnetId: !Ref PublicSubnet

  NatEIP:
     Type: AWS::EC2::EIP
     Properties:
        Domain: vpc

  PrivateRouteToNat:
     Type: AWS::EC2::Route
     Properties:
        RouteTableId: !Ref PrivateRouteTable
        DestinationCidrBlock: 0.0.0.0/0
        NatGatewayId: !Ref Nat

  S3GatewayEndpoint:
    Type: AWS::EC2::VPCEndpoint
    Properties:
      RouteTableIds:
        - !Ref PublicRouteTable
        - !Ref PrivateRouteTable
      ServiceName: !Sub com.amazonaws.${AWS::Region}.s3
      VpcId: !Ref VPC

有两个 EC2 实例 - 一个位于私有(private)子网中，一个位于公共(public)子网中。这些和相关的安全组是在第二个模板中设置的。

如果我通过公共(public) EC2 SSH 到私有(private) EC2，我可以从私有(private)子网访问 S3。含义 aws s3 ls 列出所有存储桶。

但是 - 这个请求显然是通过 NAT 进行的。因为如果我通过将其路由的 DestinationCidrBlock 设置为 1.2.3.4/32 来有效地停用它，那么 aws s3 ls 就会超时:

HTTPSConnectionPool(host='s3.amazonaws.com', port=443): 
Max retries exceeded with url: / (Caused by ConnectTimeoutError
(<botocore.awsrequest.AWSHTTPSConnection object at 0x7fd86b183828>, 
'Connection to s3.amazonaws.com timed out. (connect timeout=60)'))

所以我看了一下Why can’t I connect to an S3 bucket using a gateway VPC endpoint? :

1. 您的 VPC 中的 DNS 设置:VPC 的“DNS 解析”设置为“已启用”
2. 到 Amazon S3 的路由表设置:有一条路由
3. 安全组出站规则:无限制
4. 网络 ACL 规则:无限制
5. 网关 VPC 端点策略:无限制
6. S3 存储桶策略:我正在使用 ListBucket 进行测试

知道我必须在模板中调整什么吗？

Answer 1

您的 VPC 设置正确(减去缺少 DependsOn)。我使用复制粘贴来复制您的设置，启动了两个实例，一个是公共(public)的，一个是私有(private)的，一切都按预期进行。

我还删除了 NAT 网关，并且 s3 访问仍然在私有(private)子网中工作。为了仔细检查，我删除了 S3 VPC 网关，对 s3 的访问停止了，表明流量正在通过网关。

因此，一定发生了其他事情，与 VPC 设置无关。也许与你的实例有关？不过，我使用了 us-east-1 区域，因此 eu-central-1 中可能存在一些区域问题？