alloverse/dynroute53n

自动更新Route53记录指向ECS Fargate任务公网IP

当你在AWS ECS+Fargate上部署带有公网IP的容器后，可能需要自动更新Route53记录以指向该IP，从而通过域名稳定访问服务。由于Fargate公网IP仅在运行时可知（且实例数可能大于1），此镜像可解决该问题，无需修改主应用容器。

核心功能

• 自动获取ECS Fargate任务的公网IP
• 动态更新指定Route53域名记录指向该IP
• 与主应用容器同任务运行，无需额外基础设施

使用场景

• 部署在AWS ECS Fargate上的服务，需要通过固定域名访问且公网IP动态变化
• 使用Terraform管理基础设施，需自动化DNS记录更新

配置说明

IAM权限配置

ECS任务需具备以下IAM权限：ec2:DescribeNetworkInterfaces、ecs:DescribeTasks、route53:ChangeResourceRecordSets。以下是Terraform配置示例：

terraform
resource "aws_iam_role" "ecs_task_role" {
  name = "service-task-role"
  assume_role_policy = data.aws_iam_policy_document.ecs_task_role_assume_policy.json
}

data "aws_iam_policy_document" "ecs_task_role_assume_policy" {
  statement {
    effect  = "Allow"
    actions = ["sts:AssumeRole"]
    principals {
      type = "Service"
      identifiers = ["ecs-tasks.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "route53_policy" {
  statement {
    effect  = "Allow"
    actions = ["ec2:DescribeNetworkInterfaces", "ecs:DescribeTasks"]
    resources = ["*"]
  }
  statement {
    effect  = "Allow"
    actions = ["route53:ChangeResourceRecordSets"]
    resources = ["arn:aws:route53:::hostedzone/${var.prod_zone.zone_id}"]
  }
}

resource "aws_iam_policy" "ecs_task_role_policy" {
  name   = "service-task-role-policy"
  policy = data.aws_iam_policy_document.route53_policy.json
}

resource "aws_iam_role_policy_attachment" "ecs_task_role_policy" {
  role       = aws_iam_role.ecs_task_role.id
  policy_arn = aws_iam_policy.ecs_task_role_policy.arn
}

环境变量设置

在容器定义中需设置以下环境变量：

• R53_HOST：目标域名（如app.example.com）
• R53_ZONEID：Route53托管区域ID

容器定义示例（JSON）：

json
{
  "essential": true,
  "memory": 100,
  "name": "dynroute53n",
  "cpu": 256,
  "image": "alloverse/dynroute53n:latest",
  "environment": [
    {"name": "R53_HOST", "value": "app.places.example.com"},
    {"name": "R53_ZONEID", "value": "ZXXXXXXXXXXXXXX"}
  ],
  "requiresCompatibilities": ["FARGATE"],
  "logConfiguration": {
    "logDriver": "awslogs",
    "options": {
      "awslogs-group": "service-log-group",
      "awslogs-region": "eu-north-1",
      "awslogs-stream-prefix": "dynroute53n-app"
    }
  }
}