AWS ECS: Cannot connect to webserver running in EC2 instance - amazon-web-services

Question

I'm using the AWS CDK to create what should be a simple infrastructure:
A single EC2 instance;
Running a webserver from a Docker image;
Using Elastic Container Service (ECS) so I don't have to manage the container
I can get it all up and running but am unable to reach the webserver (e.g. by visiting the EC2 instance's IP in the browser, or with wget), and I can't figure out why I can't reach it.
Things I've tried/discovered:
In the same CDK script I can directly create an EC2 instance, run the docker image, and connect to it across the Internet. So the image and VPC are working as expected.
I've tried the AWS_VPC and BRIDGE network modes in my task definition with the same outcome (everything runs, but I can't connect to the server)
If I use AWS_VPC mode I end up with two network interfaces associated with my EC2 instance. Even if I make sure both have security groups allowing incoming port-80 traffic I still can't connect directly to the EC2 instance.
I've looked over all of the official ecs and ec2 examples. I'm doing the same things that the examples are doing, though none of the examples seem to set up a web-visible server.
I've read over the CDK docs for ecs and ec2, but couldn't find an explanation there.
I've done side-by-side comparisons of the network & security settings for a plain EC2 instance that is reachable versus the EC2-managed-by-ECS instance that isn't -- they seem to be functionally equivalent.
Everything outside of the container seems to be set up to enable talking to the EC2 instance over the web, so I'm assuming it's something about the task/container itself. My best guess is that it has something to do with the task's network mode, but I haven't found a configuration or documentation that's gotten me to the answer.
Does anyone have an idea why I can't reach this EC2 instance? Or have any example CDK scripts doing something similar to this for reference?
Here's the minimum CDK script that I expect to result in a reachable webserver (but doesn't), using a demo nginx container as a hello-world:
import {
Stack,
StackProps,
aws_ec2 as ec2,
aws_ecs as ecs,
} from 'aws-cdk-lib';
import { Construct } from 'constructs';
export class MyStack extends Stack {
constructor(scope: Construct, id: string, props?: StackProps) {
super(scope, id, props);
// VPC
const vpc = new ec2.Vpc(this, 'VPC', {
enableDnsSupport: true,
enableDnsHostnames: true,
subnetConfiguration: [{ name: 'PublicSubnet', subnetType: ec2.SubnetType.PUBLIC }],
});
// ECS
const cluster = new ecs.Cluster(this, 'Cluster', {
vpc,
capacity: {
instanceType: ec2.InstanceType.of(ec2.InstanceClass.T3, ec2.InstanceSize.NANO),
machineImage: ecs.EcsOptimizedImage.amazonLinux(),
desiredCapacity: 1,
},
});
cluster.connections.allowFromAnyIpv4(ec2.Port.tcp(80));
// TASK DEFINITION
const taskDefinition = new ecs.Ec2TaskDefinition(this, 'TaskDef', {
networkMode: ecs.NetworkMode.AWS_VPC,
});
const container = taskDefinition.addContainer('HelloWorldContainer', {
image: ecs.ContainerImage.fromRegistry('nginxdemos/hello'),
memoryReservationMiB: 256,
portMappings: [
{
containerPort: 80,
protocol: ecs.Protocol.TCP,
},
],
});
const service = new ecs.Ec2Service(this, 'Service', {
cluster,
taskDefinition,
});
service.connections.allowFromAnyIpv4(ec2.Port.tcp(80));
}
}

Answer 1

Finally found the answer:
To connect directly to an EC2 instance that is being managed by ECS, the task Network Mode needs to be "host" . That lets you use the instance like a regular EC2 instance.
In retrospect the relevant docs were pretty clear, I just didn't quite grok them the first time through.