amazon-web-services - ecs-agent 没有足够的权限在 ECS 集群中注册

Question

已关闭。这个问题是 not reproducible or was caused by typos 。目前不接受答案。

---

这个问题是由拼写错误或无法再重现的问题引起的。虽然类似的问题可能是 on-topic在这里，这个问题的解决方式不太可能帮助 future 的读者。

已关闭 5 年前。

Improve this question

我正在尝试部署运行 ecs-agent 的 EC2 实例。此类 EC2 实例由与特定角色关联的实例配置文件授予一些权限。

当 ecs-agent 运行并尝试在 ECS 集群中注册自身时，失败:

2017-11-23T10:24:09Z [INFO] Starting Agent: Amazon ECS Agent - v1.14.0 (f88e52e)                          
2017-11-23T10:24:09Z [INFO] Loading configuration                                                         

2017-11-23T10:24:09Z [DEBUG] Environment variable empty: 
ECS_CONTAINER_STOP_TIMEOUT                       
2017-11-23T10:24:09Z [DEBUG] Environment variable empty: 
ECS_ENGINE_TASK_CLEANUP_WAIT_DURATION            
2017-11-23T10:24:09Z [DEBUG] Environment variable empty: 
ECS_IMAGE_MINIMUM_CLEANUP_AGE                    
2017-11-23T10:24:09Z [DEBUG] Environment variable empty: 
ECS_IMAGE_CLEANUP_INTERVAL                       
2017-11-23T10:24:09Z [DEBUG] Loaded config: Cluster: instanceprofiletest-EcsCluster-1NA2C3753PUSZ, Region: eu-west-1, DataDir: /data, 
Checkpoint: true, AuthType: , UpdatesEnabled: true, DisableMetrics: false, ReservedMem: 0, TaskCleanupWaitDuration: 3h0m0s, DockerStopTimeout: 30s                                                                                                                                    

2017-11-23T10:24:09Z [INFO] Checkpointing is enabled. Attempting to load state                            
2017-11-23T10:24:09Z [INFO] Loading state! module="statemanager"                                          

2017-11-23T10:24:09Z [INFO] Event stream ContainerChange start listening...                               

2017-11-23T10:24:09Z [INFO] Detected Docker versions [1.17 1.18 1.19 1.20 1.21 1.22 1.23]                 
2017-11-23T10:24:09Z [WARN] Error getting valid credentials (AKID ): NoCredentialProviders: no valid providers in chain. Deprecated.                                                                                
    For verbose messaging see aws.Config.CredentialsChainVerboseErrors                                

2017-11-23T10:24:09Z [INFO] Registering Instance with ECS                                                 

2017-11-23T10:24:09Z [ERROR] Could not register: NoCredentialProviders: no valid providers in chain. Deprecated.                                                                                                    
    For verbose messaging see aws.Config.CredentialsChainVerboseErrors                                

2017-11-23T10:24:09Z [ERROR] Error registering: NoCredentialProviders: no valid providers in chain. Deprecated.                                                                                                     
    For verbose messaging see aws.Config.CredentialsChainVerboseErrors 

我尝试定义一个最小的 Cloudformation 堆栈来帮助我解决问题。

{
    "AWSTemplateFormatVersion": "2010-09-09",
    "Description": "AWS CloudFormation template to provision the BATS RabbitMQ resources",
    "Parameters": {
        "KeyName": {
            "Type": "String",
            "Description": "The Key name"
        },
        "VpcId": {
            "Type": "String",
            "Description": "The VPC id"
        },
        "SubnetId": {
            "Type": "String",
            "Description": "The subnet id"
        },
        "AllowedSshCidr": {
            "Type": "String",
            "Description": "CIDR/IP range to allow SSH access"
        }
    },
    "Resources": {
        "EcsCluster": {
            "Type": "AWS::ECS::Cluster"
        },
        "ClientSecurityGroup": {
            "Type": "AWS::EC2::SecurityGroup",
            "Properties": {
                "GroupDescription": "Security group containing the RabbitMQ client applications",
                "VpcId": { "Ref": "VpcId" }
            }
        },
        "EcsSecurityGroup": {
            "Type": "AWS::EC2::SecurityGroup",
            "Properties": {
                "GroupDescription": "ECS Allowed Ports",
                "VpcId": { "Ref": "VpcId" },
                "SecurityGroupIngress": [
                    {
                        "IpProtocol": "tcp",
                        "FromPort": 22,
                        "ToPort": 22,
                        "CidrIp": {
                            "Ref": "AllowedSshCidr"
                        }
                    }
                ]
            }
        },
        "EcsInstanceRole": {
            "Type": "AWS::IAM::Role",
            "Description": "The role for managing ECS instances",
            "Properties": {
                "AssumeRolePolicyDocument": {
                    "Statement": [
                        {
                            "Sid": "1",
                            "Effect": "Allow",
                            "Principal": {
                                "Service": [
                                    "ecs.amazonaws.com"
                                ]
                            },
                            "Action": [
                                "sts:AssumeRole"
                            ]
                        }
                    ]
                },
                "Path": "/",
                "Policies": [
                    {
                        "PolicyName": "ECS-permissions",
                        "PolicyDocument": {
                            "Version": "2012-10-17",
                            "Statement": [
                                {
                                    "Sid": "2",
                                    "Effect": "Allow",
                                    "Action": [
                                        "ecs:CreateCluster",
                                        "ecs:DeregisterContainerInstance",
                                        "ecs:DiscoverPollEndpoint",
                                        "ecs:Poll",
                                        "ecs:RegisterContainerInstance",
                                        "ecs:StartTelemetrySession",
                                        "ecs:Submit*"
                                    ],
                                    "Resource": "*"
                                },{
                                    "Sid": "3",
                                    "Effect": "Allow",
                                    "Action": [
                                        "ecr:GetAuthorizationToken",
                                        "ecr:BatchCheckLayerAvailability",
                                        "ecr:GetDownloadUrlForLayer",
                                        "ecr:BatchGetImage"
                                    ],
                                    "Resource": "*"
                                },{
                                    "Sid": "4",
                                    "Effect": "Allow",
                                    "Action": [
                                        "iam:PassRole"
                                    ],
                                    "Resource": "*"
                                }
                            ]
                        }
                    }
                ]
            }
        },
        "EcsInstanceProfile": {
            "Type": "AWS::IAM::InstanceProfile",
            "Description": "The InstanceProfile using ECSInstanceRole to manage the EcsInstance",
            "Properties": {
                "Path": "/",
                "Roles": [ { "Ref": "EcsInstanceRole" } ]
            }
        },
        "EcsInstance": {
            "Type": "AWS::EC2::Instance",
            "Properties": {
                "ImageId": "ami-48f9a52e",
                "InstanceType": "t2.micro",
                "IamInstanceProfile": { "Ref": "EcsInstanceProfile" },
                "KeyName": { "Ref": "KeyName" },
                "SecurityGroupIds": [
                    {
                        "Fn::GetAtt": [
                            "EcsSecurityGroup",
                            "GroupId"
                        ]
                    }
                ],
                "SubnetId": { "Ref": "SubnetId" },
                "UserData": {
                    "Fn::Base64": {
                        "Fn::Join": [
                            "",
                            [
                                "#!/bin/bash\n",
                                "echo ECS_CLUSTER=",
                                {
                                    "Ref": "EcsCluster"
                                },
                                " >> /etc/ecs/ecs.config\n",
                                "echo ECS_LOGLEVEL=debug >> /etc/ecs/ecs.config\n",
                                "n=0 \n",
                                "try=3 \n",
                                "until [[ $n -ge $try ]] \n",
                                "do \n",
                                "    docker start  ecs-agent && break || { \n",
                                "        echo \"ECS Agent Failed..\" \n",
                                "        ((n++)) \n",
                                "        sleep 4 \n",
                                "        sudo /etc/init.d/docker restart \n",
                                "    } \n",
                                "done \n"
                            ]
                        ]
                    }
                }
            }
        },
        "ElasticIp": {
            "Type" : "AWS::EC2::EIP",
            "Properties" : {
                "Domain" : "vpc"
            }
        },
        "EIPAssociation": {
            "Type": "AWS::EC2::EIPAssociation",
            "Properties": {
                "InstanceId": {
                    "Ref": "EcsInstance"
                },
                "EIP": { "Ref": "ElasticIp" }
            }
        }
    },
    "Outputs": {
    }
}

我通过运行来部署它:

aws cloudformation create-stack --stack-name instanceprofiletest --templatebody instanceprofiletest.json --parameters ParameterKey=KeyName,ParameterName=[my-key]  ParameterKey=SubnetId,ParameterValue=[my-subnet] ParameterKey=VpcId,ParameterValue=[my-vpc] ParameterKey=AllowedSshCidr,ParameterValue=[my-ip]/32

堆栈部署成功，但是ecs-agent容器启动失败，/var/log/ecs/ecs-agent.log显示NoCredentialProviders如上所述。

不幸的是，我无法检查授予实例配置文件的权限。我只能得到它的名字:

[ec2-user@ip-10-0-0-104 ~]$ curl http://169.254.169.254/latest/meta-data/iam/info
{
  "Code" : "Success",
  "LastUpdated" : "2017-11-23T14:45:26Z",
  "InstanceProfileArn" : "arn:aws:iam::463142558018:instance-profile/instanceprofiletest-EcsInstanceProfile-XXXXXXX",
  "InstanceProfileId" : "AIPAXXXXXXX"
}

感谢任何帮助。

Answer 1

问题是一个拼写错误。

EcsInstanceRole 的第一个语句为“ecs.amazonaws.com”，而不是“ec2.amazonaws.com”。