Network ACL inbound rule for public subnet prevents Fargate from accessing Secrets Manager

Question

I have a Fargate service in a public subnet. I've tried to limit the Public Subnet inbound traffic through Network ACLs with the following rules:

![Enter image description here](/media/postImages/original/IMsVi-wzXdRvu_wj5ADrFHcQ)

As you can see all inbound traffic except for ports 80 and 443 are blocked by rule 300. All outbound traffic are allowed:

![Enter image description here](/media/postImages/original/IMXmsVaagfRUima6VuqcTfhQ)

I have also added a VPC Endpoint to my VPC for the Secrets Manager since reading [this article](https://aws.amazon.com/premiumsupport/knowledge-center/ecs-unable-to-pull-secrets/) and still am getting this error when trying to start Fargate tasks:

![Enter image description here](/media/postImages/original/IMtJUl1FYJTLGBamqAhS-0yQ)

I tried to use VPC flow logs to detect what's being denied but am unable to spot anything meaningful.

What I'm sure about is that when rule 300 is removed all tasks will start as expected. Could someone point out what about denying all other inbound traffic is stopping Fargate tasks from accessing the Secrets Manager?

kentrad · Answer

I think you need to allow the higher [ephemeral ports ](https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html#nacl-ephemeral-ports) on the inbound rules. The Fargate task is calling the Secrets Manager endpoint over TCP 443 but there is no incoming rule to allow the response.

You could also use a VPC interface endpoint for Secrets Manager so that these requests don't leave the subnet

I did do that like this but no difference as long as NACL inbound rule 300 is there. I wonder why.

vpc.addInterfaceEndpoint(
  'SmEndpoint', {
    service: InterfaceVpcEndpointAwsService.SECRETS_MANAGER, 
    privateDnsEnabled: true, 
    open: true
  }
);

Network ACL inbound rule for public subnet prevents Fargate from accessing Secrets Manager

Relevant content