amazon-web-services - ECS 由于承担角色而无法创建服务

Question

尝试使用 Cloud Formation 创建 ECS 服务 (Fargate) 时出现以下错误。

Invalid request provided: CreateService error: Unable to assume role and validate the specified targetGroupArn. Please verify that the ECS service role being passed has the proper permissions. (Service: Ecs, Status Code: 400, Request ID: 32dc55bc-3b69-46dd-bf95-f3fff77c2508, Extended Request ID: null)

尝试/相关的事情:

1. 更新角色以包括 AdministratorAccess(仅用于故障排除)。
2. 允许多个服务(ecs、elb、ec2、cloudformation)承担角色(最初只是 ecs-tasks)。
3. 在 Web 控制台中成功创建 ECS 服务(相同配置)。 (但是云形成不起作用)。
4. ECS 角色尚未更新，上次成功创建 ECS 服务是在 2020 年 11 月 21 日 (/w Cloud Formation)

以下是上述错误的ECS角色和Cloud Trail事件。有没有人遇到过类似的问题或知道发生了什么？

编辑 1:包含 ECS 模板，IAM 角色和 ECS 服务属于不同的根堆栈，因此无法使用 DependsOn 属性。我们有 CI/CD 来确保 IAM 堆栈在 ECS 堆栈之前更新。

使用的 ECS 任务角色:

  EcsTaskRole:
    Type: 'AWS::IAM::Role'
    Properties:
      ManagedPolicyArns:
        - 'arn:aws:iam::aws:policy/AdministratorAccess'
        - 'arn:aws:iam::aws:policy/AmazonSQSFullAccess'
        - 'arn:aws:iam::aws:policy/AmazonS3FullAccess'
        - 'arn:aws:iam::aws:policy/AmazonSNSFullAccess'
        - 'arn:aws:iam::aws:policy/AmazonDynamoDBFullAccess'
        - 'arn:aws:iam::aws:policy/AmazonRDSFullAccess'
        - 'arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy'
        - 'arn:aws:iam::aws:policy/AmazonSSMReadOnlyAccess'
        - 'arn:aws:iam::aws:policy/AWSXrayFullAccess'
        - 'arn:aws:iam::aws:policy/AWSBatchFullAccess'
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - ecs-tasks.amazonaws.com
                - ecs.amazonaws.com
                - cloudformation.amazonaws.com
                - elasticloadbalancing.amazonaws.com
                - ec2.amazonaws.com
            Action:
              - 'sts:AssumeRole'
Outputs:
  EcsTaskRoleArn:
    Description: EcsTaskRoleArn
    Value: !GetAtt EcsTaskRole.Arn
    Export:
      Name: !Sub "${AWS::StackName}-EcsTaskRoleArn"

来自 Cloud Trail 的事件:(屏蔽了一些信息)

{
   "eventVersion":"1.08",
   "userIdentity":{
      "type":"IAMUser",
      "principalId":"********",
      "arn":"arn:aws:iam::*****:user/****",
      "accountId":"*********",
      "accessKeyId":"********",
      "userName":"********",
      "sessionContext":{
         "sessionIssuer":{
            
         },
         "webIdFederationData":{
            
         },
         "attributes":{
            "mfaAuthenticated":"false",
            "creationDate":"2021-01-01T20:48:02Z"
         }
      },
      "invokedBy":"cloudformation.amazonaws.com"
   },
   "eventTime":"2021-01-01T20:48:14Z",
   "eventSource":"ecs.amazonaws.com",
   "eventName":"CreateService",
   "awsRegion":"ap-east-1",
   "sourceIPAddress":"cloudformation.amazonaws.com",
   "userAgent":"cloudformation.amazonaws.com",
   "errorCode":"InvalidParameterException",
   "errorMessage":"Unable to assume role and validate the specified targetGroupArn. Please verify that the ECS service role being passed has the proper permissions.",
   "requestParameters":{
      "clientToken":"75e4c412-a82c-b01a-1909-cfdbe788f1f1",
      "cluster":"********",
      "desiredCount":1,
      "enableECSManagedTags":true,
      "enableExecuteCommand":false,
      "healthCheckGracePeriodSeconds":300,
      "launchType":"FARGATE",
      "loadBalancers":[
         {
            "targetGroupArn":"arn:aws:elasticloadbalancing:ap-east-1:********:listener-rule/app/********/e6a62b4cc4d13aaa/098a6759b6062f3f/f374eba8a4fb66e5",
            "containerName":"********",
            "containerPort":8080
         }
      ],
      "networkConfiguration":{
         "awsvpcConfiguration":{
            "assignPublicIp":"ENABLED",
            "securityGroups":[
               "sg-025cd908f664b25fe"
            ],
            "subnets":[
               "subnet-067502309b0359486",
               "subnet-018893d9e397ecac5",
               "subnet-0bfb736aefb90f05a"
            ]
         }
      },
      "propagateTags":"SERVICE",
      "serviceName":"********",
      "taskDefinition":"arn:aws:ecs:ap-east-1:********:task-definition/********"
   },
   "responseElements":null,
   "requestID":"32dc55bc-3b69-46dd-bf95-f3fff77c2508",
   "eventID":"3f872d94-72a7-4ced-96a6-028a6ceeacba",
   "readOnly":false,
   "eventType":"AwsApiCall",
   "managementEvent":true,
   "eventCategory":"Management",
   "recipientAccountId":"904822583864"
}

ECS服务云化模板

  MyServiceLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: my-service-log
      RetentionInDays: 365
  MyServiceTargetGroup:
    Type: 'AWS::ElasticLoadBalancingV2::TargetGroup'
    Properties:
      HealthCheckPath: /my-service/health
      HealthCheckIntervalSeconds: 300
      HealthCheckTimeoutSeconds: 10
      Name: my-service-target-group
      TargetType: ip
      Port: 8080
      Protocol: HTTP
      VpcId: !Ref VpcId
  MyServiceListenerRule:
    Type: 'AWS::ElasticLoadBalancingV2::ListenerRule'
    Properties:
      Actions:
        - Type: forward
          TargetGroupArn: !Ref MyServiceTargetGroup
      Conditions:
        - Field: path-pattern
          Values:
            - /my-service/*
      ListenerArn: !Ref AppAlbListenerArn
      Priority: 164
  MyServiceTaskDef:
    Type: 'AWS::ECS::TaskDefinition'
    Properties:
      ContainerDefinitions:
        - Name: my-service-container
          Image: !Join
            - ''
            - - !Ref 'AWS::AccountId'
              - .dkr.ecr.
              - !Ref 'AWS::Region'
              - .amazonaws.com/
              - 'Fn::ImportValue': !Sub '${RepositoryStackName}-MyServiceECR'
              - ':'
              - !Ref MyServiceVersion
          Essential: true
          PortMappings:
            - ContainerPort: 8080
              Protocol: tcp
          LogConfiguration:
            LogDriver: awslogs
            Options:
              awslogs-group: !Ref MyServiceLogGroup
              awslogs-region: !Ref AWS::Region
              awslogs-stream-prefix: my-service
      RequiresCompatibilities:
        - FARGATE
      Cpu: 256
      Memory: 512
      Family: my-service-taskdef
      NetworkMode: awsvpc
      ExecutionRoleArn:
        'Fn::ImportValue': !Sub '${IamStackName}-EcsTaskRoleArn'
      TaskRoleArn:
        'Fn::ImportValue': !Sub '${IamStackName}-EcsTaskRoleArn'
      Volumes: []
  MyServiceECS:
    Type: 'AWS::ECS::Service'
    Properties:
      DesiredCount: 1
      Cluster: !Ref EcsCluster
      TaskDefinition: !Ref MyServiceTaskDef
      LaunchType: FARGATE
      NetworkConfiguration:
        AwsvpcConfiguration:
          AssignPublicIp: ENABLED
          SecurityGroups:
            - !Ref SecurityGroupECS
          Subnets:
            - !Ref DmzSubnet1
            - !Ref DmzSubnet2
            - !Ref DmzSubnet3
      LoadBalancers:
        - ContainerName: my-service-container
          ContainerPort: '8080'
          TargetGroupArn: !Ref MyServiceListenerRule
      EnableECSManagedTags: true
      PropagateTags: SERVICE
      HealthCheckGracePeriodSeconds: 300
    DependsOn:
      - MyServiceListenerRule

Answer 1

使用 DependsOn 属性指定 AWS::ECS::Service 资源对 AWS::IAM::Policy 的依赖关系。