Cannot connect to Elasticache Redis Cluster From App Runner

[smc-dotexe]

Hello
I'm deploying a .NET Web Api to AppRunner with an Elasticache add on.
Here is my add-on .yml file for the service I called "api".

Parameters:
  App:
    Type: String
    Description: app
  Env:
    Type: String
    Description: staging
  Name:
    Type: String
    Description: api

Resources:
  RedisSubnetGroup:
    Type: AWS::ElastiCache::SubnetGroup
    Properties:
      Description: Group of subnets to place Redis into
      SubnetIds:
        !Split [',', 'subnet-12345,subnet-67890'] # existing subnets

  RedisSourceSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: 'Redis Consumer Security Group'
      VpcId: vpc-12345 # existing vpc

  RedisSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: 'Redis Security Group'
      VpcId: vpc-12345 # same existing vpc
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 6379
          ToPort: 6379
          SourceSecurityGroupId: sg-12345 #Existing security group for the VPC

  RedisIngress:
    Type: AWS::EC2::SecurityGroupIngress
    Properties:
      Description: Ingress from Fargate containers
      GroupId: !Ref 'RedisSecurityGroup'
      IpProtocol: tcp
      FromPort: 6379
      ToPort: 6379
      SourceSecurityGroupId: sg-12345

  Redis:
    Type: AWS::ElastiCache::CacheCluster
    Properties:
      Engine: redis
      CacheNodeType: cache.t3.micro
      NumCacheNodes: 1
      CacheSubnetGroupName: !Ref 'RedisSubnetGroup'
      VpcSecurityGroupIds:
        - !GetAtt 'RedisSecurityGroup.GroupId'

  RedisEndpointAddressParam:
    Type: AWS::SSM::Parameter
    Properties:
      Name: !Sub '/KarbonX/Staging/Redis2/HostName' # Other services can retrieve the endpoint from this path.
      Type: String
      Value: !GetAtt 'Redis.RedisEndpoint.Address'

  AppRunnerIAMRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: apprunner.amazonaws.com
            Action: sts:AssumeRole
      Policies:
        - PolicyName: SSMParameterAccessPolicy
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - ssm:GetParameter
                  - ssm:GetParameters
                Resource: !Sub 'arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/*'

Outputs:
  AppRunnerServiceRole:
    Description: The IAM role for the App Runner service
    Value: !Ref 'AppRunnerIAMRole'

  RedisEndpoint:
    Description: The endpoint of the redis cluster
    Value: !GetAtt 'Redis.RedisEndpoint.Address'

  RedisSourceSecurityGroup:
    Description: 'The EC2 Security Group to add to our ECS Service, in order to consume Redis.'
    Value: !Ref RedisSourceSecurityGroup

My goal is for the AppRunner service to connect to Elasticache in it's VPC.
I'm also attempting to attach a Role with the GetParameter policies because it also fails in attempting to get the SSM parameters.
But this also fails so I have to manually attach the Policy to the InstanceRole once it gets created each type I deploy.

The Redis Cluster error I get from the CloudWatch logs is:

Unhandled exception. StackExchange.Redis.RedisConnectionException: It was not possible to connect to the redis server(s). Error connecting right now. To allow this multiplexer to continue retrying until it's able to connect, use abortConnect=false in your connection string or AbortOnConnectFail=false; in your code.

This was all working before ECS Support for Docker was deprecated / archived. Now I'm attempting to migrate the application using Copilot and AppRunner.
The main difference is that the Elasitcache Redis Cluster is being generated with the "copilot svc deploy" command rather than being referenced (I get the same error when I try this as well).

Please let me know what I'm doing wrong, I'm new to all of this.

[smc-dotexe]

Turns out I had to create and configure a VPC instead of using App Runner's default creation.
This involved creating NAT gateways with elastic ips to connect to the subnets.
Also had to initialize the environment to use the existing VPC that I just created along with the security groups.
The addon/template.yml file needed to list create a VPC Connector resource.

So a lot of trial and error and after about a week of troubleshooting I was finally able to figure it out.

This is what my environment manifest.yml file looks like:

network:
  vpc:
    id: vpc-****
    subnets:
      public:
        - id: subnet-****
        - id: subnet-****
      private:
        - id: subnet-****
        - id: subnet-****

Here is what I had to adjust in the service manifest file:

network:
  vpc:
    id: vpc-****
    placement: private # important to connect to elasticache
    security_groups:
      - sg-****
      - sg-****

This is what my addon/template.yml file looks like:

Resources:
  MyTableAccessPolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Sid: DDBActions
            Effect: Allow
            Action:
              - ssm:GetParameters
              - ssm:GetParameter
            Resource: '*'
  MyVpcConnector:
    Type: AWS::AppRunner::VpcConnector
    Properties:
      VpcConnectorName: kx-staging-vpc-connector
      Subnets:
        - subnet-****
        - subnet-****
      SecurityGroups:
        - sg-****
        - sg-****
Outputs:
  MyTableAccessPolicyArn:
    Description: 'The ARN of the ManagedPolicy to attach to the task role.'
    Value: !Ref MyTableAccessPolicy
  VpcConnectorName:
    Description: 'Name of the VPC Connector'
    Value: !Ref MyVpcConnector

For creation of the VPC and NAT gateways, I followed this article:
https://mk-dir.com/blogs/how_to_set_up_aws_app_runner_with_elasticache_and_mongodb

I may have duplicated some work and some statements could possibly be not necessary to add. But this is the stage where I'm at now and it's working (minus cognito in a different region, but that's a different issue)

[dannyrandall]

Glad you were able to get it working! In case you're curious in the future, Copilot will automatically create a VPC Connector for you if you set network.vpc.placement to "private", which may help simplify the addons you need to maintain.