EC2 实例不能在私有子网内使用 yum

Question

我的 AWS 架构是这样的：

我可以从公共子网内的实例连接到私有子网内的实例。我想在私有子网内的实例上安装一些软件包，但我不能，因为

yum

需要连接到互联网。所以我暂时将私有子网路由表更改为与公共子网相同，以便有可能下载所需的包。但是，我仍然得到这样的错误：

Loaded plugins: extras_suggestions, langpacks, priorities, update-motd
Could not retrieve mirrorlist https://amazonlinux-2-repos-eu-central-1.s3.dualstack.eu-central-1.amazonaws.com/2/core/latest/x86_64/mirror.list error was
12: Timeout on https://amazonlinux-2-repos-eu-central-1.s3.dualstack.eu-central-1.amazonaws.com/2/core/latest/x86_64/mirror.list: (28, "Failed to connect to amazonlinux-2-repos-eu-central-1.s3.dualstack.eu-central-1.amazonaws.com port 443 after 2701 ms: Couldn't connect to server")


 One of the configured repositories failed (Unknown),
 and yum doesn't have enough cached data to continue. At this point the only
 safe thing yum can do is fail. There are a few ways to work "fix" this:

     1. Contact the upstream for the repository and get them to fix the problem.

     2. Reconfigure the baseurl/etc. for the repository, to point to a working
        upstream. This is most often useful if you are using a newer
        distribution release than is supported by the repository (and the
        packages for the previous distribution release still work).

     3. Run the command with the repository temporarily disabled
            yum --disablerepo=<repoid> ...

     4. Disable the repository permanently, so yum won't use it by default. Yum
        will then just ignore the repository until you permanently enable it
        again or use --enablerepo for temporary usage:

            yum-config-manager --disable <repoid>
        or
            subscription-manager repos --disable=<repoid>

     5. Configure the failing repository to be skipped, if it is unavailable.
        Note that yum will try to contact the repo. when it runs most commands,
        so will have to try and fail each time (and thus. yum will be be much
        slower). If it is a very temporary problem though, this is often a nice
        compromise:

            yum-config-manager --save --setopt=<repoid>.skip_if_unavailable=true

Cannot find a valid baseurl for repo: amzn2-core/2/x86_64

我猜这是互联网连接的问题，因为当我尝试使用

ping google.com

时，它会丢失所有包裹。

私有子网内实例的出站规则

Answer 1

为了能够访问互联网，一个实例必须是或者：

• 在具有公共 IP 地址的公共子网中，或者
• 在私有子网中，路由表条目指向公共子网中的 NAT 网关

当您将子网从 Private 更改为 Public 时，您的实例仍然没有 Public IP 地址。您可以创建一个弹性 IP 地址并将其与 EC2 实例相关联，然后它将为其提供一个公共 IP 地址并将其连接到 Internet。

如果您不想将子网从私有更改为公共，则您需要一个 NAT 网关（需额外付费）。