AWS批处理cloudformation-“CanNotPullContainerError”

Question

我有一个云形成模板的AWS批处理POC有6个资源。

• 3 AWS::IAM::Role
• 1 AWS：：Batch：：ComputeEnvironment
• 1 AWS::Batch::JobQueue
• 1 AWS::Batch::JobDefinition

使用的角色是：

• 1到AWS：：Batch：：ComputeEnvironment
• 2到AWS::Batch::JobDefinition

但即使使用策略“arn：aws：iam：：aws：policy/administratoraccess”，我在rin作业时也会得到“CanNotPullContainerError：错误响应from daemon：get https://*********.dkr.ecr.eu-west-1.amazonaws.com/v2/:net/http：request canceled while while while while while while waiting headers（client.timeout exceed while awaiting headers）”。

质疑者：所有都是FARGATE（计算机环境和作业），而不是EC2

        AWSTemplateFormatVersion: '2010-09-09'                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             
        Description: Creates a POC AWS Batch environment.
        Parameters:
          Environment:
            Type: String
            Description: 'Environment Name'
            Default: TEST
          Subnets:
            Type: List<AWS::EC2::Subnet::Id>
            Description: 'List of Subnets to boot into'
          ImageName:
            Type: String
            Description: 'Name and tag of Process Container Image'
            Default: 'upload:6.0.0'

        Resources:
          BatchServiceRole:
            Type: 'AWS::IAM::Role'
            Properties:
              RoleName: !Join ['', ['Demo', BatchServiceRole]]
              AssumeRolePolicyDocument:
                Version: 2012-10-17
                Statement:
                  - Effect: 'Allow'
                    Principal:
                      Service: 'batch.amazonaws.com'
                    Action: 'sts:AssumeRole'
              ManagedPolicyArns:
                - 'arn:aws:iam::aws:policy/AdministratorAccess'
          BatchContainerRole:
            Type: 'AWS::IAM::Role'
            Properties:
              RoleName: !Join ['', ['Demo', BatchContainerRole]]
              AssumeRolePolicyDocument:
                Version: 2012-10-17
                Statement:
                  - 
                    Effect: 'Allow'
                    Principal:
                      Service:
                        - 'ecs-tasks.amazonaws.com'
                    Action: 
                      - 'sts:AssumeRole'
              ManagedPolicyArns:
                - 'arn:aws:iam::aws:policy/AdministratorAccess'
          BatchJobRole:
            Type: 'AWS::IAM::Role'
            Properties:
              RoleName: !Join ['', ['Demo', BatchJobRole]]
              AssumeRolePolicyDocument:
                Version: 2012-10-17
                Statement:
                  - Effect: 'Allow'
                    Principal:
                      Service: 'ecs-tasks.amazonaws.com'
                    Action: 'sts:AssumeRole'
              ManagedPolicyArns:
                - 'arn:aws:iam::aws:policy/AdministratorAccess'
          BatchCompute:
            Type: "AWS::Batch::ComputeEnvironment"
            Properties:
              ComputeEnvironmentName: DemoContentInput
              ComputeResources: 
                MaxvCpus: 256 
                SecurityGroupIds:
                  - sg-0b33333333333333
                Subnets: !Ref Subnets
                Type: FARGATE
              ServiceRole: !Ref BatchServiceRole
              State: ENABLED
              Type: Managed
          Queue:
            Type: "AWS::Batch::JobQueue"
            DependsOn: BatchCompute
            Properties:
              ComputeEnvironmentOrder: 
                - ComputeEnvironment: DemoContentInput 
                  Order: 1
              Priority: 1
              State: "ENABLED"
              JobQueueName: DemoContentInput
          ContentInputJob:
            Type: "AWS::Batch::JobDefinition"
            Properties:
              Type: Container
              ContainerProperties: 
                Command: 
                  - -v
                  - process
                  - new-file
                  - -o
                  - s3://contents/{content_id}/{content_id}.mp4
                Environment:
                  - Name: SECRETS
                    Value: !Join [ ':', [ '{{resolve:secretsmanager:common.secrets:SecretString:aws_access_key_id}}', '{{resolve:secretsmanager:common.secrets:SecretString:aws_secret_access_key}}' ] ] 
                  - Name: APPLICATION 
                    Value: upload
                  - Name: API_KEY 
                    Value: '{{resolve:secretsmanager:common.secrets:SecretString:fluzo.api_key}}'
                  - Name: CLIENT
                    Value: upload-container
                  - Name: ENVIRONMENT
                    Value: !Ref Environment
                  - Name: SETTINGS
                    Value: !Join [ ':', [ '{{resolve:secretsmanager:common.secrets:SecretString:aws_access_key_id}}', '{{resolve:secretsmanager:common.secrets:SecretString:aws_secret_access_key}}', 'upload-container' ] ] 
                ExecutionRoleArn: 'arn:aws:iam::**********:role/DemoBatchJobRole'
                Image: !Join ['', [!Ref 'AWS::AccountId','.dkr.ecr.', !Ref 'AWS::Region', '.amazonaws.com/', !Ref ImageName ] ] 
                JobRoleArn: !Ref BatchContainerRole
                ResourceRequirements:
                  - Type: VCPU
                    Value: 1
                  - Type: MEMORY
                    Value: 2048
              JobDefinitionName: DemoContentInput
              PlatformCapabilities:
                - FARGATE
              RetryStrategy: 
                Attempts: 1
              Timeout: 
                AttemptDurationSeconds: 600 

在AWS：：Batch：：JobQueue：ContainerProperties：ExecutionRoLearn中，我对arn进行了编码，因为如果write！ref BatchJobRole，我会得到一个错误。但这不是我问这个问题的目的。

问题是如何在我运行作业时避免“CanNotPullContainerError：后台进程的错误响应：Get https://*********.dkr.ecr.eu-west-1.amazonaws.com/v2/:net/http：request canceled while while waiting for connection（client.timeout exceped while awaiting headers）”。

Answer 1

听起来好像你不能从你的子网内部到达internet。

确保：

• 有一个internet网关设备与您的VPC相关联（如果没有，请创建一个--即使您只是使用nat-gateway进行出口）
• 与子网相关联的路由表有一个到internet网关或NAT网关的默认路由(0.0.0./0)，并附加了弹性IP。
• 附加的安全组具有允许端口和协议的出站internet流量(0.0.0.0/0)的规则。（例如80/HTTP、443/HTTPS)
• 与子网关联的网络访问控制列表（网络ACL）具有允许到Internet的出站和入站流量的规则。

https://aws.amazon.com/premiumsupport/knowledge-center/ec2-connect-internet-gateway/