amazon-web-services - AWS::事件::规则失败调用调试信息？

Question

我有一个 AWS::Event::Rule 将 S3 put 事件路由到 ECS 任务。我可以看到规则正在从指标中触发，而且还可以在每个触发器上看到 FailedInitation。我怀疑这是权限/策略问题，但无法找到任何调试信息或日志。这些调试信息在某处可用吗？

我在 Lambda 作为目标时看到了类似的问题，它需要 Lambda 端的额外权限以允许事件触发，但无法找到 ECS 的类似设置？ AWS Cloudformation - Invocation of Lambda by Rule Event failed

以下是相关的 CloudFormation 代码，其中显示了 ECS 目标的当前角色:

Resources:
  ECSTrigger:
    Type: AWS::Events::Rule
    Properties:
      ...
      Targets: # target of trigger: ECS
        - Arn:
            Fn::Sub: 'arn:aws:ecs:${AWS::Region}:${AWS::AccountId}:cluster/${ClusterName}'
          Id: 'EcsTriggerTarget'
          InputTransformer:
            InputPathsMap:
              s3_bucket: "$.detail.requestParameters.bucketName"
              s3_key: "$.detail.requestParameters.key"
            InputTemplate: '{"containerOverrides": [{"environment": [{"name": "S3_BUCKET", "value": <s3_bucket>}, {"name": "S3_KEY", "value": <s3_key>}]}]}'
          EcsParameters:
            LaunchType: FARGATE
            PlatformVersion: LATEST
            TaskCount: 1
            TaskDefinitionArn:
              Ref: Task
            NetworkConfiguration:
              AwsVpcConfiguration:
                AssignPublicIp: DISABLED
                SecurityGroups: ...
                Subnets: ...
          RoleArn:
            Fn::GetAtt: EcsTriggerRole.Arn

  EcsTriggerRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Action: 'sts:AssumeRole'
            Principal:
              Service: 'events.amazonaws.com'
      ManagedPolicyArns:
        - Fn::Sub: 'arn:${AWS::Partition}:iam::aws:policy/service-role/AmazonEC2ContainerServiceEventsRole'

Answer 1

我今天与 AWS 的支持工程师讨论了这个问题。根据他们的说法，调试任何 FailedInitation 问题都必须在资源级别完成，而不能在 EventBridge 级别进行调试。来 self 们的聊天:

I just confirmed from internal cloudwatch team, cloudwatch do not provide any logs for failed invocation. Apart from the failedinvocation metrics, there is no logging avaialble from cloudwatch side.As mentioned, you need to rely on lambda logs or resources logs.

换句话说，如果您的规则调用 ECS(资源)，则唯一可用的调试日志来自 ECS，而不是来自 EventBridge。我要求支持工程师代表我的团队提交功能请求，因此您也可以考虑通过 AWS 支持 channel 执行此操作。