AWS忽略taskSubnets选择

Question

我有一个烧瓶应用程序，我试图部署到一个着陆区，使用CDK (类型转换，v2.5.0)作为一个Fargate实例。

着陆区是我需要使用的现有VPC，带有隔离的私有子网。

我尝试了我能想到的每一个组合，以使负载均衡器(尝试了应用程序和网络平衡)使用孤立的子网，但是没有什么效果。

我从cdk synth得到的错误是

deploy/node_modules/aws-cdk-lib/aws-ec2/lib/vpc.ts:401
      throw new Error(`There are no '${subnetType}' subnet groups in this VPC. Available types: ${availableTypes}`);
            ^
*Error: There are no 'Public' subnet groups in this VPC. Available types: Isolated*

这是我的密码：

import * as cdk from "@aws-cdk/core";
import { Stack, StackProps } from "aws-cdk-lib";
import { Construct } from "constructs";
import * as ec2 from "aws-cdk-lib/aws-ec2";
import * as ecs from "aws-cdk-lib/aws-ecs";
import * as ecsp from "aws-cdk-lib/aws-ecs-patterns";

export class DeployStack extends Stack {
  constructor(scope: Construct, id: string, props?: StackProps) {

    super(scope, id, props);

    const defaultnonprodVPC = "existing-vpc";

    const defaultVPC = ec2.Vpc.fromLookup(this,
      "defaultVPC",
      {
        isDefault: false,
        vpcId: defaultnonprodVPC,
        tags: { "aws-cdk:subnet-type": "isolated" }
      }
    );

    const knownIsolatedSubnets = defaultVPC.isolatedSubnets;

    const monitoringSubnets = defaultVPC.selectSubnets(
      {
        subnetType: ec2.SubnetType.PRIVATE_ISOLATED
      }
    );

    const networkBalancedFargateService = new ecsp.NetworkLoadBalancedFargateService(this,
      "ConnectorMonitorService", {
        memoryLimitMiB: 512,
        desiredCount: 1,
        cpu: 256,
        taskImageOptions: {
          image: ecs.ContainerImage.fromAsset("../src")
        },
        taskSubnets:
          {
            subnetType: ec2.SubnetType.PRIVATE_ISOLATED
          },
        vpc: defaultVPC
      });
  }
}

将taskSubnets更改为

{ subnets: { knownIsolatedSubnets } }

或

subnetGroupName: "subnet-existing-subnet-name"

或

monitoringSubnets

对cdk synth没有任何影响。设置assignPublicIp: false也不会改变任何事情。

我做错什么了，还是失踪了？

Answer 1

NetworkLoadBalancedFargateService有一个属性publicLoadBalancer，默认情况下它是true。这使得负载均衡器面向互联网，这是不正确的情况下。您需要将其设置为false，以便私有或孤立子网工作。

NetworkLoadBalancedFargateService文档