CannotPullContainerError in the private network

Question

Docker, Fargate containers are being pulled into the private network. It fails.
Now I have the following error:
```
CannotPullContainerError: ref pull has been retried 5 time(s): failed to copy: httpReadSeeker: failed open: failed to do request: Get "https://prod-eu-west-1-starport-layer-bucket.s3.eu-west-1.amazonaws.com/x-x-x/x-x-c33888f3c2b2?X-Amz-Security-Token=XXXX...
```
The network is public with the internet gateway but without public IP. The main idea is to close the service from the outside world and allow only ELB.
I tried to add endpoints to VCP, it passed to another error. Now I am stuck.

Endpoints:
* com.amazonaws.eu-west-1.ecr.dkr Interface
* com.amazonaws.eu-west-1.ecr.api	com.amazonaws.eu-west-1.s3 Interface
* com.amazonaws.eu-west-1.secretsmanager Interface
* com.amazonaws.s3-global.accesspoint	Interface
* com.amazonaws.eu-west-1.s3-outposts	Interface

Honestly, I understand the idea but I do not know all details.
I've not found an article on how to configure Fargate in a private network.

Help me to clarify the current case.
Should I use just enable public IP for fargate? I do not like this because of a security reason that I see.

Regards, Victor.

Answer

Hi

> The network is public with the internet gateway but without public IP

If you do not want to assign public ip to Fargate, you should create another subnet(private subnet) associated with route table that has default route to NAT Gateway or NAT instance. Or you should create another subnet(private subnet)　 with VPC endpoint. Even though subnet has default route to internet gateway,  instance used by Fargate can not reach out to the internet without public ip.

May be this article will help you.
https://repost.aws/knowledge-center/ecs-fargate-pull-container-error

Answer

Hello,

From the above error it is failing to connect to the "starport" S3 bucket which is used by ECR to store your image layers. Since you are deploying it your Fargate containers in a private subnet, ensure that you have a S3 gateway endpoint. If you already have a S3 gateway endpoint, ensure that you have a policy that allows access to the "starport" bucket.

Refer to: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html#ecr-setting-up-s3-gateway and https://repost.aws/knowledge-center/ecs-ecr-docker-image-error for more information.

```
{
  "Statement": [
    {
      "Sid": "Access-to-specific-bucket-only",
      "Principal": "*",
      "Action": [
        "s3:GetObject"
      ],
      "Effect": "Allow",
      "Resource": ["arn:aws:s3:::prod-region-starport-layer-bucket/*"]
    }
  ]
}
```

If any issues, please feel free to reach out.

CannotPullContainerError in the private network

Relevant content