Fargate上的Spring无法连接到AWS SES

Question

我试图通过我在Fargate的容器上运行的Java应用程序发送电子邮件。我的容器在API网关后面的VPC中运行，与外部服务的连接通过VPCendpoint进行。

所有的infra都是使用Terraform部署的。Java应用在本地运行正常，但部署到AWS时运行不正常，所以我认为缺少一个配置。

Java应用程序遵循以下AWS指南：

https://docs.aws.amazon.com/ses/latest/dg/send-email-raw.html

以下是地形代码中的一些尖晶石：

# SECURITY GROUPS
resource "aws_security_group" "security_group_containers" {
  name   = "security_group_containers_${var.project_name}_${var.environment}"
  vpc_id = var.vpc_id

  ingress {
    protocol         = "-1"
    from_port        = 0
    to_port          = 0
    cidr_blocks      = ["0.0.0.0/0"]
    ipv6_cidr_blocks = ["::/0"]
    self             = true
  }

  egress {
    protocol         = "-1"
    from_port        = 0
    to_port          = 0
    cidr_blocks      = ["0.0.0.0/0"]
    ipv6_cidr_blocks = ["::/0"]
  }

  tags = {
    Name        = "security_group_containers_${var.project_name}_${var.environment}"
  }
}

resource "aws_security_group" "security_group_ses" {
  name        = "security_group_ses_${var.project_name}_${var.environment}"
  vpc_id      = var.vpc_id

  ingress {
    protocol    = "-1"
    from_port   = 0
    to_port     = 0
    cidr_blocks      = ["0.0.0.0/0"]
    ipv6_cidr_blocks = ["::/0"]
  }

  egress {
    protocol    = "-1"
    from_port   = 0
    to_port     = 0
    cidr_blocks = ["0.0.0.0/0"]
  }

  tags = {
    Name = "security_group_ses_${var.project_name}_${var.environment}"
  }
}

# VPC

resource "aws_vpc" "main" {
    cidr_block           = var.cidr
    enable_dns_support   = true
    enable_dns_hostnames = true
  }

resource "aws_subnet" "private_subnet" {
    vpc_id            = aws_vpc.main.id
    cidr_block        = var.private_subnets[0]
    availability_zone = "us-east-1b"

    tags = {
        Name= "private_subnet_${var.project_name}_${var.environment}"
    }
}


# VPC ENDPOINT
resource "aws_vpc_endpoint" "ses_endpoint" {
  security_group_ids  = [aws_security_group.security_group_ses]
  service_name        = "com.amazonaws.${var.aws_region}.email-smtp"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = [aws_subnet.private_subnet.id]
  private_dns_enabled = true
  tags = {
    "Name" = "vpc_endpoint_ses_${var.project_name}_${var.environment}"
  }
  vpc_id = aws_vpc.main.id
}

如果有任何重要的服务丢失告诉我，以便我可以添加它。

正如你所看到的，我保持所有交通畅通，所以这里找到的解决方案对我不适用。当应用程序尝试发送电子邮件时，我发现以下错误：

software.amazon.awssdk.core.exception.SdkClientException: Unable to execute HTTP request: Connect to email.us-east-1.amazonaws.com:443 [email.us-east-1.amazonaws.com/52.0.170.238, email.us-east-1.amazonaws.com/54.234.96.52, email.us-east-1.amazonaws.com/34.239.37.81, email.us-east-1.amazonaws.com/18.208.125.60, email.us-east-1.amazonaws.com/52.204.223.71, email.us-east-1.amazonaws.com/18.235.72.5, email.us-east-1.amazonaws.com/18.234.10.182, email.us-east-1.amazonaws.com/44.194.249.132] failed: connect timed out

我认为我缺少一些配置，无法让java awssdk使用VPCendpoint。

Answer 1

您已经为SES SMTP API创建了VPCendpoint，但收到的错误消息是电子邮件。美国东部1号。亚马逊。com:443用于AWS SES服务API。你可以在这里看到这两套API。如果您正在使用AWS SDK与Java应用程序中的SES交互，则需要将VPCendpoint更改为service_name=“com.amazonaws.${var.AWS_region}.email”

如果将Java应用程序配置为使用SMTP（如JavaMail API），则当前的endpoint配置将起作用。