I followed this AWS Tutorial on setting up a task on AWS ECS Fargate https://docs.aws.amazon.com/AmazonECS/latest/userguide/ECS_AWSCLI_Fargate.html
I have an image in ECR, I have setup the Cluster and the Service, as well as the task definition and yet nothing, is running. I have to manually run the task in the aws console to get it to start and when I update the service with a new task definition the running task does not get updated even with a force deployment.
I wanted a very simple setup so I have no ELB or AutoScaling policy and the following setup for the service:
Number of tasks 1
Minimum healthy percent 100
Maximum percent 200
Deployment Type: Rolling Update
I feel like I am missing something, my task are not starting automatically and not updating upon service update.
I have attached below the deploy code I am using in my bitbucket pipeline if that helps at all:
#!/bin/bash
set -e
# possible -b (base / app name) -i (image version), -e (deploy env) and -s (service id)
while getopts b:i:e:s:r: option
do
case "${option}"
in
b) BASE_NAME=${OPTARG};;
i) IMG_VERSION=${OPTARG};;
e) DEPLOY_ENV=${OPTARG};;
s) SERVICE_ID=${OPTARG};;
r) EXECUTION_ROLE=${OPTARG};;
esac
done
echo "BASE_NAME: " $BASE_NAME
echo "IMG_VERSION: " $IMG_VERSION
echo "DEPLOY_ENV: " $DEPLOY_ENV
echo "SERVICE_ID: " $SERVICE_ID
echo "EXECUTION_ROLE: " $EXECUTION_ROLE
if [ -z "$BASE_NAME" ]; then
echo "exit: No BASE_NAME specified"
exit;
fi
if [ -z "$SERVICE_ID" ]; then
echo "exit: No SERVICE_ID specified"
exit;
fi
if [ -z "$DEPLOY_ENV" ]; then
echo "exit: No DEPLOY_ENV specified"
exit;
fi
if [ -z "$IMG_VERSION" ]; then
echo "exit: No IMG_VERSION specified"
exit;
fi
if [ -z "$EXECUTION_ROLE" ]; then
echo "exit: No EXECUTION_ROLE specified"
exit;
fi
# Define variables
TASK_FAMILY=${BASE_NAME}-${DEPLOY_ENV}-${SERVICE_ID}
SERVICE_NAME=${BASE_NAME}-${DEPLOY_ENV}-${SERVICE_ID}-service
CLUSTER_NAME=${BASE_NAME}-${DEPLOY_ENV}-cluster
IMAGE_PACEHOLDER="<IMAGE_VERSION>"
CONTAINER_DEFINITION_FILE=$(cat ${BASE_NAME}-$SERVICE_ID.container-definition.json)
CONTAINER_DEFINITION="${CONTAINER_DEFINITION_FILE//$IMAGE_PACEHOLDER/$IMG_VERSION}"
export TASK_VERSION=$(aws ecs register-task-definition --family ${TASK_FAMILY} --container-definitions "$CONTAINER_DEFINITION" --requires-compatibilities '["FARGATE"]' --cpu "512" --memory "1024" --network-mode "awsvpc" --execution-role-arn ${EXECUTION_ROLE} | jq --raw-output '.taskDefinition.revision')
echo "Registered ECS Task Definition: " $TASK_VERSION
if [ -n "$TASK_VERSION" ]; then
echo "Update ECS Cluster: " $CLUSTER_NAME
echo "Service: " $SERVICE_NAME
echo "Task Definition: " $TASK_FAMILY:$TASK_VERSION
#Update ECS Service
DEPLOYED_SERVICE=$(aws ecs update-service --cluster $CLUSTER_NAME --service $SERVICE_NAME --task-definition $TASK_FAMILY:$TASK_VERSION --force-new-deployment | jq --raw-output '.service.serviceName')
echo "Deployment of $DEPLOYED_SERVICE complete"
else
echo "exit: No task definition"
exit;
fi
EDIT:
Here is my task definition:
{
"ipcMode": null,
"executionRoleArn": "arn:aws:iam::<Account-id>:role/:arn:aws:iam::<Account-id>:role/ecsTaskExecutionRole",
"containerDefinitions": [
{
"dnsSearchDomains": null,
"logConfiguration": null,
"entryPoint": [],
"portMappings": [
{
"hostPort": 80,
"protocol": "tcp",
"containerPort": 80
},
{
"hostPort": 443,
"protocol": "tcp",
"containerPort": 443
}
],
"command": [],
"linuxParameters": null,
"cpu": 0,
"environment": [],
"resourceRequirements": null,
"ulimits": null,
"dnsServers": null,
"mountPoints": [],
"workingDirectory": "/usr/share/nginx/html/",
"secrets": null,
"dockerSecurityOptions": null,
"memory": null,
"memoryReservation": null,
"volumesFrom": [],
"stopTimeout": null,
"image": "<Account-id>.dkr.ecr.us-east-1.amazonaws.com/<my-ecr-image>:latest",
"startTimeout": null,
"dependsOn": null,
"disableNetworking": null,
"interactive": null,
"healthCheck": null,
"essential": true,
"links": null,
"hostname": null,
"extraHosts": null,
"pseudoTerminal": null,
"user": null,
"readonlyRootFilesystem": null,
"dockerLabels": null,
"systemControls": null,
"privileged": null,
"name": "dig-website"
}
],
"placementConstraints": [],
"memory": "1024",
"taskRoleArn": null,
"compatibilities": [
"EC2",
"FARGATE"
],
"taskDefinitionArn": "arn:aws:ecs:us-east-1:<Account-id>:task-definition/myapp-production-website:11",
"family": "myapp-production-website",
"requiresAttributes": [
{
"targetId": null,
"targetType": null,
"value": null,
"name": "com.amazonaws.ecs.capability.docker-remote-api.1.17"
},
{
"targetId": null,
"targetType": null,
"value": null,
"name": "ecs.capability.execution-role-ecr-pull"
},
{
"targetId": null,
"targetType": null,
"value": null,
"name": "com.amazonaws.ecs.capability.docker-remote-api.1.18"
},
{
"targetId": null,
"targetType": null,
"value": null,
"name": "ecs.capability.task-eni"
},
{
"targetId": null,
"targetType": null,
"value": null,
"name": "com.amazonaws.ecs.capability.ecr-auth"
}
],
"pidMode": null,
"requiresCompatibilities": [
"FARGATE"
],
"networkMode": "awsvpc",
"cpu": "512",
"revision": 11,
"status": "ACTIVE",
"proxyConfiguration": null,
"volumes": []
}
Solved my issue. The error originated from an argument I passed to my bitbucket pipeline.
I have an env variable in my pipeline to populate the execution role, what I did not know is that all I needed to pass to the aws cli for ecs register-task was the name of the role and not the full ARN like shown below:
"executionRoleArn": "arn:aws:iam::<Account-id>:role/:arn:aws:iam::<Account-id>:role/ecsTaskExecutionRole"
which should be instead:
"executionRoleArn": "arn:aws:iam::<Account-id>:role/ecsTaskExecutionRole"
because it can't resolve the arn it will throw an error saying the role does not have the right permissions.