By using AWS re:Post, you agree to the AWS re:Post Terms of Use
AWS re:Postre:Post

Not able to make AWS ECS service accessible over public domain mapped to service discovery

0

i have created an ECS service and during creation i have enabled service discovery, which in its turn create a namespace in cloudmap service, then cloudmap have created a hosted zone in Rout53 for the ecs service, then i have used that cloud map provided dns name as a CNAME to my domain sub.example.com which is located in different public hosted zone,Enter image description here

I have tested the endpoint internally and it's working but while browsing the public domain, i get error DNS_PROBE_FINISHED_NXDOMAIN

so, any suggestions why this mapping did not work ?

Topics
Networking & Content DeliveryContainers
Tags
AWS Cloud MapAmazon Elastic Container ServiceAmazon Route 53ECS Service Discovery
Language
English
mma
asked a year ago882 views
1 Answer
0

Hello,

Here are some questions/things to consider:

  1. Assuming your ECS cluster is in a private subnet behind an ALB, do you have a NAT Gateway configured in a public subnet with security groups allowing the default traffic to the NAT?
  2. Is you Route 53 zone setup correctly? As in are you using the appropriate Alias/CNAME records? Is your hosted zone in route 53 public?
  3. Are your security groups configured to allow the traffic or are there any firewalls or NACLs blocking traffic?
  4. Have you enabled FlowLogs and checked to see if you see the incoming traffic to your ECS cluster or not?
  5. If using an ALB, do you have logging enabled for that as well?
Cloud_G
answered a year ago
  • mma
    a year ago

    1. i don't use ALB as i wanted actually to use service discovery feature instead.

    2. the public hosted zone is the public domain name we already use for our platform, there i should create a subdomain mapped to the ecs service discovery record created in the private hosted zone, after enabling service discovery, cloud map service creates a private hosted zone with 4 record, i should acutally map the public sub-domain to the SRV record in the private hosted zone.

    3. ec2 security group and subnets NACL are open to most of traffic.

    4. i did not have enabled flow logs but i can access the service through the service discovery endpoint in local vpc

    5. i don't use ALB

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions

Relevant content