amazon-web-servicesaws-lambdaamazon-iamamazon-ecsamazon-rekognition

AWS ECS Fargate service task unable to access AWS Rekognition service - 504 Gateway Timeout

I have setup an ECS Fargate service. Task is setup with a task role. Also, I have a VPC endpoint setup for the Rekognition service. However, I am getting a 504 Gateway timeout when calling the Rekognition service API.

Please note that I am able to make a call to the S3 buckets with a similar setup.

What am I missing when connecting to the Rekognition API?

Task Role Policy:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "rekognition:*"
            ],
            "Resource": "*"
        }
    ]
}

Task Role Trust Relations:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "",
            "Effect": "Allow",
            "Principal": {
                "Service": "ecs-tasks.amazonaws.com"
            },
            "Action": "sts:AssumeRole"
        }
    ]
}

Service Security Group Inbound/Outbound Rules: enter image description here

Subnets: ECS Services are running in a private subnet.

Solution

  • Upon rechecking my network configurations, I realized I had not enabled the Private DNS names flag preventing me from using the Rekognition API. Thanks to @MarkB for the help.

    To summarize:

    1. ECS Fargate service's task has a Task Role, which allows access to the Rekognition Service. In my case, I attached the AmazonRekognitionFullAccess policy to the Task Role.
    2. ECS Service's security group has the required Inbound/Outbound rules.
    3. VPC Endpoint -> If the services are in a private subnet and you want to make a private call -> Add a VPN Endpoint with the service name com.amazonaws.us-west-2.rekognition. Also, enable the Private DNS names.
    4. VPC Endpoints security group has the required Inbound/Outbound rules. And VPC Endpoint Policy is set up as needed.