部署脚本概述
本方案在 AWS 上部署一套生产级的无服务器容器集群基线，采用 ECS on Fargate + ALB 的参考架构，具备以下特性：
- VPC 三层网络：公有/私有子网，NAT 出网（生产可用）
- ECS 集群（Fargate 容器）：私有子网运行，最小权限 IAM，CloudWatch 日志
- 应用负载均衡 ALB（公网）：HTTPS 监听，HTTP 自动重定向 HTTPS
- 自动伸缩：基于平均 CPU 的目标追踪伸缩（可配置）
- 安全加固：安全组最小暴露，仅开放 ALB 80/443；ECS 仅允许来自 ALB 的容器端口
- 基础观测：ECS/ALB 健康检查，CloudWatch 日志；部署完成自动验证稳定性和 HTTP 连通性
- IaC 与状态管理：Terraform（S3 远程状态 + DynamoDB 锁）
- 无硬编码凭证：通过 AWS CLI/环境变量加载，Secrets Manager 支持（可选）
适用场景：生产环境的容器化服务对外发布，作为后续微服务扩展与流水线集成的基线模板。
前置依赖
- AWS 账号与权限
- 能创建：VPC/ALB/ECS/Fargate/IAM/CloudWatch/S3/DynamoDB/ACM
- 工具
- Terraform ≥ 1.5
- AWS CLI ≥ 2.9
- jq ≥ 1.6
- bash（Linux/macOS）
- 证书
- 已在同一区域准备好 ACM 证书 ARN（域名归属验证通过）
- 容器镜像
- 已存在可拉取的镜像（ECR 或公共镜像），形如 123456789012.dkr.ecr.eu-west-1.amazonaws.com/app:prod 或 public.ecr.aws/nginx:latest
核心脚本代码
以下为完整可执行的部署脚本与 Terraform 配置。将文件保存到同一目录后执行 deploy.sh 即可完成部署与验证。
- deploy.sh（部署与验证，带错误处理与远程状态初始化）
#!/usr/bin/env bash
set -euo pipefail
# -------- Configurable Environment --------
: "${AWS_REGION:=eu-west-1}" # 设置默认区域
: "${PROJECT_NAME:=myapp}" # 项目名
: "${ENVIRONMENT:=production}" # 环境名（已设为 production）
: "${TF_STATE_BUCKET:=}" # 可留空，由脚本自动按规范生成
: "${TF_STATE_DDB_TABLE:=}" # 可留空，由脚本自动生成
: "${DOMAIN_CERT_ARN:=}" # 必填：ACM 证书 ARN
: "${CONTAINER_IMAGE:=}" # 必填：容器镜像
: "${ALLOWED_CIDRS:=0.0.0.0/0}" # 可限制来源 IP CIDR，多个用逗号分隔
# -------- Helpers --------
log() { printf "[%s] %s\n" "$(date '+%F %T')" "$*"; }
err() { printf "[%s] ERROR: %s\n" "$(date '+%F %T')" "$*" >&2; }
trap 'err "部署失败。请查看上述日志。"' ERR
# -------- Preflight --------
command -v aws >/dev/null || { err "缺少 aws CLI"; exit 1; }
command -v terraform >/dev/null || { err "缺少 terraform"; exit 1; }
command -v jq >/dev/null || { err "缺少 jq"; exit 1; }
[ -n "${DOMAIN_CERT_ARN}" ] || { err "必须设置 DOMAIN_CERT_ARN（ALB HTTPS 证书 ARN）"; exit 1; }
[ -n "${CONTAINER_IMAGE}" ] || { err "必须设置 CONTAINER_IMAGE（容器镜像）"; exit 1; }
aws sts get-caller-identity >/dev/null
AWS_ACCOUNT_ID="$(aws sts get-caller-identity --query Account --output text)"
REGION="${AWS_REGION}"
# -------- Remote state (S3 + DynamoDB) --------
if [ -z "${TF_STATE_BUCKET}" ]; then
TF_STATE_BUCKET="${PROJECT_NAME}-${ENVIRONMENT}-tfstate-${AWS_ACCOUNT_ID}-${REGION}"
fi
if [ -z "${TF_STATE_DDB_TABLE}" ]; then
TF_STATE_DDB_TABLE="${PROJECT_NAME}-${ENVIRONMENT}-tf-lock"
fi
log "准备远程状态：S3=${TF_STATE_BUCKET}, DDB=${TF_STATE_DDB_TABLE}"
if ! aws s3api head-bucket --bucket "${TF_STATE_BUCKET}" 2>/dev/null; then
log "创建 S3 bucket 用于 Terraform 状态"
aws s3api create-bucket \
--bucket "${TF_STATE_BUCKET}" \
--region "${REGION}" \
--create-bucket-configuration LocationConstraint="${REGION}"
aws s3api put-bucket-versioning --bucket "${TF_STATE_BUCKET}" --versioning-configuration Status=Enabled
aws s3api put-bucket-encryption --bucket "${TF_STATE_BUCKET}" --server-side-encryption-configuration '{"Rules":[{"ApplyServerSideEncryptionByDefault":{"SSEAlgorithm":"AES256"}}]}'
aws s3api put-public-access-block --bucket "${TF_STATE_BUCKET}" --public-access-block-configuration '{
"BlockPublicAcls": true, "IgnorePublicAcls": true, "BlockPublicPolicy": true, "RestrictPublicBuckets": true
}'
fi
if ! aws dynamodb describe-table --table-name "${TF_STATE_DDB_TABLE}" >/dev/null 2>&1; then
log "创建 DynamoDB 表用于 Terraform 锁"
aws dynamodb create-table \
--table-name "${TF_STATE_DDB_TABLE}" \
--attribute-definitions AttributeName=LockID,AttributeType=S \
--key-schema AttributeName=LockID,KeyType=HASH \
--billing-mode PAY_PER_REQUEST
aws dynamodb wait table-exists --table-name "${TF_STATE_DDB_TABLE}"
fi
# -------- Terraform Init/Plan/Apply --------
log "Terraform 初始化"
terraform init \
-backend-config="bucket=${TF_STATE_BUCKET}" \
-backend-config="key=${PROJECT_NAME}/${ENVIRONMENT}.tfstate" \
-backend-config="region=${REGION}" \
-backend-config="dynamodb_table=${TF_STATE_DDB_TABLE}"
log "Terraform 格式化与校验"
terraform fmt -recursive
terraform validate
log "Terraform 规划"
terraform plan \
-var="region=${REGION}" \
-var="project_name=${PROJECT_NAME}" \
-var="environment=${ENVIRONMENT}" \
-var="certificate_arn=${DOMAIN_CERT_ARN}" \
-var="container_image=${CONTAINER_IMAGE}" \
-var="allowed_source_cidrs=${ALLOWED_CIDRS}" \
-out=tfplan
log "Terraform 部署"
terraform apply -auto-approve tfplan
log "读取输出"
OUT_JSON="$(terraform output -json)"
ALB_DNS=$(echo "$OUT_JSON" | jq -r '.alb_dns_name.value')
CLUSTER=$(echo "$OUT_JSON" | jq -r '.ecs_cluster_name.value')
SERVICE=$(echo "$OUT_JSON" | jq -r '.ecs_service_name.value')
TG_ARN=$(echo "$OUT_JSON" | jq -r '.target_group_arn.value')
log "等待 ECS 服务稳定"
aws ecs wait services-stable --cluster "$CLUSTER" --services "$SERVICE"
log "等待 ALB Target 组健康"
for i in {1..30}; do
UNHEALTHY=$(aws elbv2 describe-target-health --target-group-arn "$TG_ARN" \
--query "TargetHealthDescriptions[?TargetHealth.State!='healthy'] | length(@)" --output text)
if [ "$UNHEALTHY" = "0" ]; then
log "所有 Target 已健康"
break
fi
log "Target 未全部健康，重试 $i/30 ..."
sleep 10
done
log "基本连通性测试（HTTPS）"
set +e
HTTP_CODE=$(curl -k -s -o /dev/null -w "%{http_code}" "https://${ALB_DNS}/")
set -e
log "ALB: https://${ALB_DNS} 返回状态码: ${HTTP_CODE}"
log "部署完成"
echo "ECS Cluster: ${CLUSTER}"
echo "ECS Service: ${SERVICE}"
echo "ALB DNS: https://${ALB_DNS}"
- versions.tf
terraform {
required_version = ">= 1.5.0"
required_providers {
aws = {
source = "hashicorp/aws"
version = "~> 5.57"
}
}
}
provider "aws" {
region = var.region
}
- backend.tf（占位，实际参数由 deploy.sh 注入）
terraform {
backend "s3" {}
}
- variables.tf
variable "region" {
type = string
description = "AWS 区域"
}
variable "project_name" {
type = string
description = "项目名称"
}
variable "environment" {
type = string
description = "环境标识"
default = "production"
}
variable "vpc_cidr" {
type = string
default = "10.20.0.0/16"
description = "VPC CIDR"
}
variable "public_subnets" {
type = list(string)
description = "公有子网 CIDRs（2个）"
default = ["10.20.0.0/24", "10.20.1.0/24"]
}
variable "private_subnets" {
type = list(string)
description = "私有子网 CIDRs（2个）"
default = ["10.20.10.0/24", "10.20.11.0/24"]
}
variable "container_image" {
type = string
description = "容器镜像 URI（ECR 或公共仓库），必须存在可拉取的 tag"
}
variable "container_port" {
type = number
default = 8080
description = "应用容器端口"
}
variable "certificate_arn" {
type = string
description = "ALB HTTPS 监听所用的 ACM 证书 ARN"
}
variable "cpu" {
type = number
default = 512
description = "Fargate Task CPU（256/512/1024/2048/4096）"
}
variable "memory" {
type = number
default = 1024
description = "Fargate Task 内存（匹配 CPU 要求）"
}
variable "desired_count" {
type = number
default = 2
description = "ECS 服务期望副本数（生产建议>=2）"
}
variable "min_capacity" {
type = number
default = 2
description = "自动伸缩最小副本数"
}
variable "max_capacity" {
type = number
default = 10
description = "自动伸缩最大副本数"
}
variable "health_check_path" {
type = string
default = "/health"
description = "ALB 健康检查 HTTP Path"
}
variable "log_retention_days" {
type = number
default = 30
description = "CloudWatch 日志保留天数"
}
variable "allowed_source_cidrs" {
type = string
default = "0.0.0.0/0"
description = "允许访问 ALB 的来源 CIDR（逗号分隔）"
}
variable "task_secrets" {
description = "注入容器的 Secret 列表（来自 Secrets Manager 或 SSM Parameter Store）"
type = list(object({
name = string
valueFrom = string
}))
default = []
}
variable "tags" {
type = map(string)
default = {}
description = "额外资源标签"
}
- main.tf
locals {
name_prefix = "${var.project_name}-${var.environment}"
tags = merge({
Project = var.project_name
Environment = var.environment
ManagedBy = "Terraform"
}, var.tags)
}
data "aws_caller_identity" "current" {}
data "aws_region" "current" {}
# ---------------- VPC & Networking ----------------
resource "aws_vpc" "main" {
cidr_block = var.vpc_cidr
enable_dns_hostnames = true
enable_dns_support = true
tags = merge(local.tags, { Name = "${local.name_prefix}-vpc" })
}
resource "aws_internet_gateway" "igw" {
vpc_id = aws_vpc.main.id
tags = merge(local.tags, { Name = "${local.name_prefix}-igw" })
}
# 两个可用区
data "aws_availability_zones" "available" {
state = "available"
}
resource "aws_subnet" "public" {
for_each = {
az1 = { cidr = var.public_subnets[0], az = data.aws_availability_zones.available.names[0] }
az2 = { cidr = var.public_subnets[1], az = data.aws_availability_zones.available.names[1] }
}
vpc_id = aws_vpc.main.id
cidr_block = each.value.cidr
availability_zone = each.value.az
map_public_ip_on_launch = true
tags = merge(local.tags, { Name = "${local.name_prefix}-public-${each.key}", Tier = "public" })
}
resource "aws_subnet" "private" {
for_each = {
az1 = { cidr = var.private_subnets[0], az = data.aws_availability_zones.available.names[0] }
az2 = { cidr = var.private_subnets[1], az = data.aws_availability_zones.available.names[1] }
}
vpc_id = aws_vpc.main.id
cidr_block = each.value.cidr
availability_zone = each.value.az
tags = merge(local.tags, { Name = "${local.name_prefix}-private-${each.key}", Tier = "private" })
}
resource "aws_route_table" "public" {
vpc_id = aws_vpc.main.id
tags = merge(local.tags, { Name = "${local.name_prefix}-public-rt" })
}
resource "aws_route" "public_igw" {
route_table_id = aws_route_table.public.id
destination_cidr_block = "0.0.0.0/0"
gateway_id = aws_internet_gateway.igw.id
}
resource "aws_route_table_association" "public_assoc" {
for_each = aws_subnet.public
subnet_id = each.value.id
route_table_id = aws_route_table.public.id
}
# 单 NAT（成本友好，可按需扩展为多 NAT）
resource "aws_eip" "nat" {
domain = "vpc"
tags = merge(local.tags, { Name = "${local.name_prefix}-nat-eip" })
}
resource "aws_nat_gateway" "nat" {
allocation_id = aws_eip.nat.id
subnet_id = aws_subnet.public["az1"].id
tags = merge(local.tags, { Name = "${local.name_prefix}-nat" })
depends_on = [aws_internet_gateway.igw]
}
resource "aws_route_table" "private" {
vpc_id = aws_vpc.main.id
tags = merge(local.tags, { Name = "${local.name_prefix}-private-rt" })
}
resource "aws_route" "private_nat" {
route_table_id = aws_route_table.private.id
destination_cidr_block = "0.0.0.0/0"
nat_gateway_id = aws_nat_gateway.nat.id
}
resource "aws_route_table_association" "private_assoc" {
for_each = aws_subnet.private
subnet_id = each.value.id
route_table_id = aws_route_table.private.id
}
# ---------------- Security Groups ----------------
resource "aws_security_group" "alb" {
name = "${local.name_prefix}-alb-sg"
description = "Allow HTTP/HTTPS from allowed sources"
vpc_id = aws_vpc.main.id
dynamic "ingress" {
for_each = split(",", replace(var.allowed_source_cidrs, " ", ""))
content {
description = "HTTP from ${ingress.value}"
from_port = 80
to_port = 80
protocol = "tcp"
cidr_blocks = [ingress.value]
}
}
dynamic "ingress" {
for_each = split(",", replace(var.allowed_source_cidrs, " ", ""))
content {
description = "HTTPS from ${ingress.value}"
from_port = 443
to_port = 443
protocol = "tcp"
cidr_blocks = [ingress.value]
}
}
egress {
from_port = 0
to_port = 0
protocol = "-1"
cidr_blocks = ["0.0.0.0/0"]
}
tags = merge(local.tags, { Name = "${local.name_prefix}-alb-sg" })
}
resource "aws_security_group" "ecs_tasks" {
name = "${local.name_prefix}-ecs-sg"
description = "Allow ALB to reach ECS tasks"
vpc_id = aws_vpc.main.id
ingress {
description = "App traffic from ALB"
from_port = var.container_port
to_port = var.container_port
protocol = "tcp"
security_groups = [aws_security_group.alb.id]
}
egress {
from_port = 0
to_port = 0
protocol = "-1"
cidr_blocks = ["0.0.0.0/0"]
}
tags = merge(local.tags, { Name = "${local.name_prefix}-ecs-sg" })
}
# ---------------- ALB ----------------
resource "aws_lb" "app" {
name = substr("${local.name_prefix}-alb", 0, 32)
load_balancer_type = "application"
internal = false
security_groups = [aws_security_group.alb.id]
subnets = [for s in aws_subnet.public : s.id]
tags = merge(local.tags, { Name = "${local.name_prefix}-alb" })
}
resource "aws_lb_target_group" "app" {
name = substr("${local.name_prefix}-tg", 0, 32)
port = var.container_port
protocol = "HTTP"
vpc_id = aws_vpc.main.id
target_type = "ip"
health_check {
enabled = true
path = var.health_check_path
matcher = "200-399"
interval = 30
healthy_threshold = 3
unhealthy_threshold = 3
timeout = 5
}
tags = merge(local.tags, { Name = "${local.name_prefix}-tg" })
}
resource "aws_lb_listener" "http" {
load_balancer_arn = aws_lb.app.arn
port = 80
protocol = "HTTP"
default_action {
type = "redirect"
redirect {
port = "443"
protocol = "HTTPS"
status_code = "HTTP_301"
}
}
}
resource "aws_lb_listener" "https" {
load_balancer_arn = aws_lb.app.arn
port = 443
protocol = "HTTPS"
ssl_policy = "ELBSecurityPolicy-2016-08"
certificate_arn = var.certificate_arn
default_action {
type = "forward"
target_group_arn = aws_lb_target_group.app.arn
}
}
# ---------------- IAM ----------------
data "aws_iam_policy_document" "task_execution_trust" {
statement {
effect = "Allow"
principals {
type = "Service"
identifiers = ["ecs-tasks.amazonaws.com"]
}
actions = ["sts:AssumeRole"]
}
}
resource "aws_iam_role" "task_execution" {
name = "${local.name_prefix}-task-exec"
assume_role_policy = data.aws_iam_policy_document.task_execution_trust.json
tags = local.tags
}
resource "aws_iam_role_policy_attachment" "task_execution_attach" {
role = aws_iam_role.task_execution.name
policy_arn = "arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy"
}
resource "aws_iam_role" "task" {
name = "${local.name_prefix}-task"
assume_role_policy = data.aws_iam_policy_document.task_execution_trust.json
tags = local.tags
}
# 仅当配置了 task_secrets 时授予读取权限
data "aws_iam_policy_document" "task_inline" {
dynamic "statement" {
for_each = length(var.task_secrets) > 0 ? [1] : []
content {
effect = "Allow"
actions = [
"secretsmanager:GetSecretValue",
"ssm:GetParameter",
"ssm:GetParameters"
]
resources = ["*"]
}
}
}
resource "aws_iam_role_policy" "task_inline" {
count = length(var.task_secrets) > 0 ? 1 : 0
name = "${local.name_prefix}-task-inline"
role = aws_iam_role.task.id
policy = data.aws_iam_policy_document.task_inline.json
}
# ---------------- Logs ----------------
resource "aws_cloudwatch_log_group" "app" {
name = "/ecs/${local.name_prefix}"
retention_in_days = var.log_retention_days
tags = local.tags
}
# ---------------- ECS Cluster / Task / Service ----------------
resource "aws_ecs_cluster" "this" {
name = "${local.name_prefix}-cluster"
configuration {
execute_command_configuration {
logging = "DEFAULT"
}
}
tags = local.tags
}
resource "aws_ecs_cluster_capacity_providers" "cp" {
cluster_name = aws_ecs_cluster.this.name
capacity_providers = ["FARGATE", "FARGATE_SPOT"]
}
locals {
container_def = [{
name = "${var.project_name}"
image = var.container_image
essential = true
portMappings = [{
containerPort = var.container_port
hostPort = var.container_port
protocol = "tcp"
}]
logConfiguration = {
logDriver = "awslogs"
options = {
awslogs-group = aws_cloudwatch_log_group.app.name
awslogs-region = var.region
awslogs-stream-prefix = "ecs"
}
}
environment = []
secrets = var.task_secrets
}]
}
resource "aws_ecs_task_definition" "app" {
family = "${local.name_prefix}-taskdef"
network_mode = "awsvpc"
requires_compatibilities = ["FARGATE"]
cpu = tostring(var.cpu)
memory = tostring(var.memory)
execution_role_arn = aws_iam_role.task_execution.arn
task_role_arn = aws_iam_role.task.arn
runtime_platform {
operating_system_family = "LINUX"
cpu_architecture = "X86_64"
}
container_definitions = jsonencode(local.container_def)
tags = local.tags
}
resource "aws_ecs_service" "app" {
name = "${local.name_prefix}-svc"
cluster = aws_ecs_cluster.this.id
task_definition = aws_ecs_task_definition.app.arn
desired_count = var.desired_count
enable_execute_command = true
deployment_minimum_healthy_percent = 50
deployment_maximum_percent = 200
network_configuration {
subnets = [for s in aws_subnet.private : s.id]
security_groups = [aws_security_group.ecs_tasks.id]
assign_public_ip = false
}
load_balancer {
target_group_arn = aws_lb_target_group.app.arn
container_name = var.project_name
container_port = var.container_port
}
capacity_provider_strategy {
capacity_provider = "FARGATE"
weight = 1
}
lifecycle {
ignore_changes = [desired_count] # 方便外部伸缩修改
}
depends_on = [aws_lb_listener.https]
tags = local.tags
}
# ---------------- Application Auto Scaling ----------------
resource "aws_appautoscaling_target" "ecs" {
max_capacity = var.max_capacity
min_capacity = var.min_capacity
resource_id = "service/${aws_ecs_cluster.this.name}/${aws_ecs_service.app.name}"
scalable_dimension = "ecs:service:DesiredCount"
service_namespace = "ecs"
}
resource "aws_appautoscaling_policy" "cpu_target" {
name = "${local.name_prefix}-cpu-scaling"
policy_type = "TargetTrackingScaling"
resource_id = aws_appautoscaling_target.ecs.resource_id
scalable_dimension = aws_appautoscaling_target.ecs.scalable_dimension
service_namespace = aws_appautoscaling_target.ecs.service_namespace
target_tracking_scaling_policy_configuration {
predefined_metric_specification {
predefined_metric_type = "ECSServiceAverageCPUUtilization"
}
target_value = 60
scale_in_cooldown = 60
scale_out_cooldown = 60
}
}
# ---------------- Outputs ----------------
- outputs.tf
output "vpc_id" {
value = aws_vpc.main.id
}
output "alb_dns_name" {
value = aws_lb.app.dns_name
}
output "target_group_arn" {
value = aws_lb_target_group.app.arn
}
output "ecs_cluster_name" {
value = aws_ecs_cluster.this.name
}
output "ecs_service_name" {
value = aws_ecs_service.app.name
}
配置说明
- region：AWS 区域，如 eu-west-1
- project_name：项目名称，用于资源命名与标签
- environment：环境标识，默认为 production，用于资源隔离
- vpc_cidr/public_subnets/private_subnets：网络划分，生产建议至少两个 AZ
- container_image：容器镜像，需已存在（ECR 或公共镜像）
- container_port：容器内部监听端口，与 ALB Target 组对应
- certificate_arn：ACM 证书 ARN，要求与 ALB 同区域
- desired_count/min_capacity/max_capacity：服务副本数与自动伸缩边界
- health_check_path：ALB 健康检查路径（应用需返回 2xx/3xx）
- log_retention_days：日志保留天数
- allowed_source_cidrs：允许访问 ALB 的来源 IP 段，生产建议限制公司办公出口或 WAF
- task_secrets：注入容器的机密配置，形如
- [{ name="DB_PASSWORD", valueFrom="arn:aws:secretsmanager:...:secret:db-pass-xxxxx" }]
安全要点：
- ECS 任务安全组仅开放容器端口给 ALB 安全组
- ALB 仅开放 80/443，80 将 301 重定向到 443
- Terraform 远程状态启用 S3 版本控制与加密、DynamoDB 锁防并发
- 无硬编码凭证，凭证通过 AWS CLI/环境变量注入
部署步骤
- 保存文件
- 将上述 deploy.sh、*.tf 放到同一目录，确保 deploy.sh 可执行：chmod +x deploy.sh
- 设置环境变量
- 必填：
- export DOMAIN_CERT_ARN="arn:aws:acm:eu-west-1:123456789012:certificate/xxxx-xxxx"
- export CONTAINER_IMAGE="123456789012.dkr.ecr.eu-west-1.amazonaws.com/app:prod"
- 可选：
- export AWS_REGION="eu-west-1"
- export PROJECT_NAME="myapp"
- export ALLOWED_CIDRS="203.0.113.0/24" 仅允许公司出口
- export TF_STATE_BUCKET / TF_STATE_DDB_TABLE 自定义远程状态资源名
- 执行部署
- 首次部署后
- 如使用自建镜像仓库，请确保镜像可被拉取；如需改端口/健康检查路径，修改 variables.tf 或在 plan 时注入 -var
- 后续更新
- 修改镜像 tag 或参数后，重复执行 ./deploy.sh，会进行滚动升级
验证方法
- 自动验证：
- deploy.sh 会等待 ECS 服务稳定，Target 组健康，然后尝试访问 https://<ALB_DNS> 并输出状态码
- 手动检查：
- ALB 连通性：curl -I https://<ALB_DNS>
- 目标健康：aws elbv2 describe-target-health --target-group-arn <TG_ARN>
- 服务状态：aws ecs describe-services --cluster --services
- 日志查看：在 CloudWatch Logs 中查看 /ecs/ 日志组
- 指标观测：查看 CloudWatch 指标 ECSServiceAverageCPUUtilization/ALB 5xx 等
- 故障排查：
- 403/5xx：检查应用容器日志（CloudWatch）、安全组放通、健康检查路径是否正确
- Image pull 失败：确认镜像存在、ECR 权限与执行角色策略（AmazonECSTaskExecutionRolePolicy）有效
- 证书错误：确认证书 ARN 正确、域名已验证、区域一致
备注与建议：
- NAT 网关：当前为单 NAT，生产高可用可改为每个 AZ 一个 NAT 网关
- WAF：生产建议为 ALB 绑定 AWS WAF 以加强 L7 防护
- 机密管理：优先使用 Secrets Manager/SSM，并通过 task_secrets 注入
- 访问限制：生产环境建议收紧 allowed_source_cidrs 或前置 API Gateway/PrivateLink 方案视业务而定
