AWS - 连接仅拒绝 ec2.us-east-1.amazonaws.com，但任何其他区域都可以
我的所有 ec2 实例都位于 us-east-1 中。 除一台（pfsense 机器）外，所有这些都由系统管理员管理。
当我尝试从任何计算机向“https://ec2.us-east-1.amazonaws.com”发出“curl”命令时，我收到“连接被拒绝 - 超时”。
如果我卷曲到“https://ec2.us-west-2.amazonaws.com”（或任何其他区域），它就可以工作。
当我从我的 pfsense 机器上执行相同的操作时，curl 可以正常工作。
我已经在与我的 pfsense 计算机相同的子网和相同的安全组中创建了新实例，但它仍然无法工作。
由于与 ec2.us-east-1.amazonaws.com 的连接不起作用，我的 EKS 出现问题。 作为一种缓解措施，我必须更改机器的 /etc/hosts，这样它就可以工作，但这太可怕了。
有人遇到过这样的问题吗？
All my ec2 instances are in us-east-1.
All are managed by the system manager, except one (a pfsense machine).
When I try to give a "curl" command from any machine to "https://ec2.us-east-1.amazonaws.com" I get a "connection refused - timeout".
If I curl to "https://ec2.us-west-2.amazonaws.com" (or any other region) it works.
When I do the same operation from my pfsense machine curl works correctly.
I've already created new instances in the same subnet as my pfsense machine, same security group too and it still doesn't work.
As the connection to ec2.us-east-1.amazonaws.com doesn't work I'm having problems with my EKS.
As a palliative I had to change the /etc/hosts of the machines, with this it works, but this is horrible.
Has anyone had this kind of problem?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
us-east-1 的 EC2 终端节点似乎已通过 DNS 解析为您的 VPC 内部的 IP 地址 (172.26.1.74)。其他区域 EC2 终端节点解析为其常用的公共 IP（例如 us-west-2 解析为 52.94.214.8）。
这表明您正在使用 VPC 终端节点，专门用于访问 EC2 服务。这就是导致 DNS 将 ec2.us-east-1.amazonaws.com 解析为 VPC 内的 172 地址的原因（它实际上是与 VPC 终端节点关联的 IP 地址）。
因此，请检查并更正您的 VPC 端点策略以允许相关流量。
It looks like the EC2 endpoint for us-east-1 is being DNS-resolved to an IP address (172.26.1.74) that is inside your VPC. The other regional EC2 endpoints are resolving to their usual public IPs (e.g. us-west-2 resolving to 52.94.214.8).
That suggests that you are using VPC Endpoints, specifically for access to the EC2 service. That is what causes DNS to resolve ec2.us-east-1.amazonaws.com to a 172 address inside your VPC (it's actually the IP address associated with the VPC Endpoint).
So, review and correct your VPC Endpoint policy to allow the relevant traffic.