"Execution failed" when setting up API Gateway and Fargate with AWS CDK

user_524906 0
Viewed 638

I am trying to setup AWS API Gateway to access a fargate container in a private VPC as described here. For this I am using AWS CDK as described below. But when I curl the endpoint after successful cdk deploy I get "Internal Server Error" as a response. I can't find any additional information. For some reason API GW can't reach the container.

So when I curl the endpoint like this:

curl - i https://xxx.execute-api.eu-central-1.amazonaws.com/prod/MyResource

... I get the following log output in cloud watch:

Extended Request Id: NpuEPFWHliAFm_w=
Verifying Usage Plan for request: 757c6b9e-c4af-4dab-a5b1-542b15a1ba21. API Key: API Stage: ...
PI Key authorized because method 'ANY /MyResource/{proxy+}' does not require API Key. Request will not contribute to throttle or quota limits
Usage Plan check succeeded for API Key and API Stage ...
Starting execution for request: 757c6b9e-c4af-4dab-a5b1-542b15a1ba21
HTTP Method: GET, Resource Path: /MyResource/test
Execution failed due to configuration error: There was an internal error while executing your request

CDK Code

First I create a network load balanced fargate service:

private setupService(): NetworkLoadBalancedFargateService {
    const vpc = new Vpc(this, 'MyVpc');

    const cluster = new Cluster(this, 'MyCluster', {
      vpc: vpc,
    });
    cluster.connections.allowFromAnyIpv4(Port.tcp(5050));

    const taskDefinition = new FargateTaskDefinition(this, 'MyTaskDefinition');

    const container = taskDefinition.addContainer('MyContainer', {
      image: ContainerImage.fromRegistry('vad1mo/hello-world-rest'),
    });
    container.addPortMappings({
      containerPort: 5050,
      hostPort: 5050,
    });

    const service = new NetworkLoadBalancedFargateService(this, 'MyFargateServie', {
      cluster,
      taskDefinition,
      assignPublicIp: true,
    });

    service.service.connections.allowFromAnyIpv4(Port.tcp(5050));

    return service;
}

Next I create the VpcLink and the API Gateway:

private setupApiGw(service: NetworkLoadBalancedFargateService) {
   const api = new RestApi(this, `MyApi`, {
      restApiName: `MyApi`,
      deployOptions: {
        loggingLevel: MethodLoggingLevel.INFO,
      },
    });

    // setup api resource which forwards to container
    const resource = api.root.addResource('MyResource');
    resource.addProxy({
      anyMethod: true,
      defaultIntegration: new HttpIntegration('http://localhost.com:5050', {
        httpMethod: 'ANY',
        options: {
          connectionType: ConnectionType.VPC_LINK,
          vpcLink: new VpcLink(this, 'MyVpcLink', {
              targets: [service.loadBalancer],
              vpcLinkName: 'MyVpcLink',
          }),
        },
        proxy: true,
      }),
      defaultMethodOptions: {
        authorizationType: AuthorizationType.NONE,
      },
    });
    resource.addMethod('ANY');
    this.addCorsOptions(resource);
}

Anyone has a clue what is wrong with this config?

aws-load-balancer aws-cdk aws-fargate
1 Answers

After hours of trying I finally figured out that the security groups do not seem to be updated correctly when setting up the VpcLink with CDK. Broadening the allowed connection with

service.service.connections.allowFromAnyIpv4(Port.allTraffic())

solved it. Still need to figure out which minimum set needs to be set instead of allTrafic()

Additionally I replaced localhost in the HttpIntegration by the endpoint of the load balancer like this: 

resource.addMethod("ANY", new HttpIntegration(
    'http://' + service.loadBalancer.loadBalancerDnsName, 
    {
        httpMethod: 'ANY',
        options: {
            connectionType: ConnectionType.VPC_LINK,
            vpcLink: new VpcLink(this, 'MyVpcLink', {
                targets: [service.loadBalancer],
                vpcLinkName: 'MyVpcLink',
            })
        },
    }
))
user_5249060
Related