kinit inside ECS in one VPC unable to contact KDC in another VPC

0

I have a container inside ECS which is in a VPC, say VPC1. I have an AD Server & Directory Service configured in another VPC (VPC2). These 2 VPCs are peered. However, from the ECS, when I am trying to execute kinit command(for getting Kerberos ticket), I am getting the error "Cannot contact any KDC for realm 'my-domain.com' while getting initial credentials". If the ECS is also in the same VPC, then it works fine. The peering seems to be fine. I am not at all an expert on Directory Service or VPC or DNS or Route53. So, I am struggling to fix this, although I tried a few options. Please help. It will be great, if I can get detailed steps to resolve this.

1 Answer
0

I understand that you are getting the error "Cannot contact any KDC for realm 'my-domain.com' while getting initial credentials" when trying to connect from ECS Container launched in a peered VPC. Researching on this error, I found that this error is generally seen if the machine running kinit is unable to resolve the domain controller. Now, since it is not clear as to how the AD Service and Directory Service is configured, I am unable to comment as to what can be the possible reasons for such failure in DNS Resolution from the ECS in a peered VPC. However, considering the fact that you are not seeing issues when you run the ECS Cluster in the same VPC as the AD Server. One common scenario when ECS will fail to resolve a domain is in the below case -

For example, if you create a private domain called "example.com" and associated with the VPCA then by default only resources within VPCA will be able to resolve the domain "example.com". Even if you peer the VPCA with VPCB, resources in VPCB will not be able to resolve the domain "example.com". I just wanted to let you know that generally Private hosted Zones are not resolvable outside of the VPC it is created. https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/hosted-zone-private-considerations.html

To better answer your question, we require details that are non-public information. Therefore, please open a support case with AWS using the following link

AWS
SUPPORT ENGINEER
answered 9 months ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions