amazon-web-services - 服务启动任务失败

Question

我正在尝试部署一个定义 ECS 集群、服务和任务定义的 CloudFormation 模板。当服务尝试启动任务时，会出现以下错误:

service ECSService failed to launch a task with (error ECS was unable to assume the role 'arn:aws:iam:::role/ExecutionRole' that was provided for this task. Please verify that the role being passed has the proper trust relationship and permissions and that your IAM user has permissions to pass this role.).

我将角色定义为:

  ExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: ExecutionRole
      AssumeRolePolicyDocument:
        Statement:
          - Effect: Allow
            Action: sts:AssumeRole
            Principal:
              Service: ecs-tasks.amazonaws.com
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy
      Path: /myroles

服务:

  Cluster:
    Type: AWS::ECS::Cluster
    Properties:
      ClusterName: Cluster
  Service:
    Type: AWS::ECS::Service
    DependsOn:
      - ExecutionRole
    Properties:
      Cluster: !Ref Cluster
      DesiredCount: 1
      LaunchType: FARGATE
      NetworkConfiguration:
        AwsvpcConfiguration:
          AssignPublicIp: ENABLED
          SecurityGroups:
            - !Ref SecurityGroup
          Subnets:
            - !Ref PublicSubnet
      ServiceName: ECSService
      TaskDefinition: !Ref TaskDefinition
  TaskDefinition:
    Type: AWS::ECS::TaskDefinition
    Properties:
      ContainerDefinitions:
        - Name: Container
          Image: !Ref TaskImage
      Cpu: .25 vCPU
      ExecutionRoleArn: !Ref ExecutionRole
      Family: GoCapture
      Memory: 0.5 GB
      NetworkMode: awsvpc
      RuntimePlatform:
        CpuArchitecture: X86_64
        OperatingSystemFamily: LINUX

这一切似乎都匹配 the documentation 。但显然我有问题。我错过了什么？

仅供引用，完整模板为here 。我在这里只更改了复制版本中的一些名称。但除此之外，它应该与我最初写这个问题时的时间相同。任何其他差异都是由于将更改推送到我的分支来尝试它们造成的。

Answer 1

在 github 版本中你有 Path:/gocapture/，而在 SO 中你没有它。因此，正如我之前所写，您的相关代码与实际代码不同。

我修改您的代码以删除路径:/gocapture/。

Parameters:
  TaskImage:
    Type: String
Resources:
  ExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: GoCaptureExecutionRole
      AssumeRolePolicyDocument:
        Statement:
          - Effect: Allow
            Action: sts:AssumeRole
            Principal:
              Service: ecs-tasks.amazonaws.com
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy
      #Path: /gocapture/

  TaskRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: GoCaptureTaskRole
      AssumeRolePolicyDocument:
        Statement:
          - Effect: Allow
            Action: sts:AssumeRole
            Principal:
              Service: ecs-tasks.amazonaws.com
      #Path: /gocapture/

  Vpc:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: 10.0.0.0/16

  SecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupName: GoCaptureSecurityGroup
      GroupDescription: Security Group for Go Capture ECS Service
      VpcId: !Ref Vpc

  PublicSubnet:
    Type: AWS::EC2::Subnet
    Properties:
      CidrBlock: 10.0.0.0/16
      VpcId: !Ref Vpc

  Cluster:
    Type: AWS::ECS::Cluster
    Properties:
      ClusterName: GoCaptureCluster

  Service:
    Type: AWS::ECS::Service
    Properties:
      Cluster: !Ref Cluster
      DesiredCount: 1
      LaunchType: FARGATE
      NetworkConfiguration:
        AwsvpcConfiguration:
          AssignPublicIp: ENABLED
          SecurityGroups:
            - !Ref SecurityGroup
          Subnets:
            - !Ref PublicSubnet
      ServiceName: GoCaptureECSService
      TaskDefinition: !Ref TaskDefinition

  TaskDefinition:
    Type: AWS::ECS::TaskDefinition
    Properties:
      ContainerDefinitions:
        - Name: GoCaptureContainer
          Image: !Ref TaskImage
      Cpu: .25 vCPU
      ExecutionRoleArn: !Ref ExecutionRole
      Family: GoCapture
      Memory: 0.5 GB
      NetworkMode: awsvpc
      RuntimePlatform:
        CpuArchitecture: X86_64
        OperatingSystemFamily: LINUX
      TaskRoleArn: !Ref TaskRole