Kafka-连接到MSK时ECS超时连接

Question

我将kafka-connect docker映像(confluentinc/cp-kafka-connect-base:6.0.1)部署到ECS/fargate，为我的ECS服务分配了一个安全组，该安全组允许传入的zooper keeper和kafka bootstrap服务器通信量（纯文本和TLS)，并分配了一个IAM角色，该角色允许我的ECS任务对MSK集群运行kafka操作，但connect集群在尝试从MSK集群获取代理列表时仍会超时。

在AWS中，kafka connect ECS业务和MSK集群都位于同一个专用子网上。

安全组代码

      "Type": "AWS::EC2::SecurityGroup",
      "Properties": {
        "GroupDescription": "kakfa-connect-sg",
        "SecurityGroupEgress": [
          {
            "CidrIp": "0.0.0.0/0",
            "Description": "Allow all outbound traffic by default",
            "IpProtocol": "-1"
          }
        ],
        "SecurityGroupIngress": [
          {
            "CidrIp": "0.0.0.0/0",
            "Description": "Kafka Bootstrap Server Plaintext",
            "FromPort": 9092,
            "IpProtocol": "tcp",
            "ToPort": 9092
          },
          {
            "CidrIp": "0.0.0.0/0",
            "Description": "Kafka Bootstrap Server TLS",
            "FromPort": 9094,
            "IpProtocol": "tcp",
            "ToPort": 9094
          },
          {
            "CidrIp": "0.0.0.0/0",
            "Description": "ZooKeeper TLS",
            "FromPort": 2182,
            "IpProtocol": "tcp",
            "ToPort": 2182
          },
          {
            "CidrIp": "0.0.0.0/0",
            "Description": "ZooKeeper Plaintext",
            "FromPort": 2181,
            "IpProtocol": "tcp",
            "ToPort": 2181
          }
        ],
        "VpcId": "vpc-id"
      }```

IAM role code

```{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": "kafka:*",
            "Resource": "*",
            "Effect": "Allow"
        }
    ]
}```

Is there anything i might be missing?

Answer 1

MSK群集上的安全组设置不允许来自我的kafka connect群集的通信量。