无法承担角色并验证指定的targetGroupArn.请确认所传递的ECS服务角色具有适当的权限 [英] Unable to assume role and validate the specified targetGroupArn. Please verify that the ECS service role being passed has the proper permissions

问题描述

我正在尝试创建集群，服务和任务.错误显示在Myservice中，原因是Unable to assume role and validate the specified targetGroupArn. Please verify that the ECS service role being passed has the proper permissions.我在做什么错?我尚未附加所有关联文件，只是提供了我认为发生错误的yml文件.
role.yml

I am trying to create a cluster, service and task. The error occurs in Myservice as it says Unable to assume role and validate the specified targetGroupArn. Please verify that the ECS service role being passed has the proper permissions. What am I doing wrong? I haven't attached all associated files, I have just provided the yml file where I think the error occurs.
role.yml

---
AWSTemplateFormatVersion: 2010-09-09 
Resources:

  ExRole:
      Type: 'AWS::IAM::Role'
      Properties:
        AssumeRolePolicyDocument:
          Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Principal:
                Service:
                  - ecs-tasks.amazonaws.com
              Action:
                - 'sts:AssumeRole'
        Path: /
        ManagedPolicyArns:
          - arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy
        Policies: 
          - PolicyName: AccessECR
            PolicyDocument:
              Version: '2012-10-17'
              Statement:
                - Effect: Allow
                  Action: 
                    - ecr:BatchGetImage
                    - ecr:GetAuthorizationToken
                    - ecr:GetDownloadUrlForLayer 
                  Resource: '*'

  ContainerInstanceRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'               
        Statement:
          - Effect: Allow
            Principal: 
                Service: 
                    - ec2.amazonaws.com
            Action: 
                - sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceforEC2Role
      Path: '/'

  InstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties: 
      Roles: 
        - !Ref ContainerInstanceRole      

Outputs:
  
  ExRole:
    Description: Task excution role
    Value: !Ref ExRole
    Export:
        Name: "ExRole"
  InstanceProfile:
    Description: profile for container instances
    Value: !Ref InstanceProfile
    Export:
        Name: "InstanceProfile"            

Clusterandservice.yml

Clusterandservice.yml

---
AWSTemplateFormatVersion: 2010-09-09

Parameters:

  KeyName:
    Type: AWS::EC2::KeyPair::KeyName
    Default: wahaj(webserver)

  DesiredCapacity:
    Type: Number
    Default: 2

  MinSize:
    Type: Number
    Default: 1

  MaxSize:
    Type: Number
    Default: 4  

  InstanceProfile:
    Type: String

  DefaultTargetGroup:
    Type: String

  Task:
    Type: String

  Albsg:
    Type: String

  VpcID:
    Type: String

  SubnetA:
    Type: String
      
  SubnetB:
    Type: String


Resources:

  MyCluster:
      Type: AWS::ECS::Cluster
      Properties: {}

  wahajwebserver:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupName: wahaj-webserver
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 22
          ToPort: 22
          CidrIp: 0.0.0.0/0
        - IpProtocol: tcp
          FromPort: 0
          ToPort: 65535
          SourceSecurityGroupId: !Ref Albsg
          Description: For traffic from Internet
      GroupDescription: Security Group for demo server
      VpcId: !Ref VpcID

  Myservice:
      Type: AWS::ECS::Service
      Properties: 
          Cluster: !Ref MyCluster        
          DeploymentController:   
              Type: ECS
          DesiredCount: 2
          LaunchType: EC2
          LoadBalancers: 
              - ContainerName: python
                ContainerPort: 8080
                TargetGroupArn: !Ref DefaultTargetGroup
          Role: !Ref InstanceProfile
          SchedulingStrategy: REPLICA
          ServiceName: Python-service
          TaskDefinition: !Ref Task

  ec2instance:
    Type: AWS::AutoScaling::LaunchConfiguration
    Properties:
      UserData:
        Fn::Base64: !Sub |
          #!/bin/bash -xe

          yum update -y && yum install -y aws-cfn-bootstrap 

          echo ECS_CLUSTER=${MyCluster} >> /etc/ecs/ecs.config
          echo ECS_BACKEND_HOST= >> /etc/ecs/ecs.config           

          /opt/aws/bin/cfn-signal -e $? \
                --stack ${AWS::StackName} \
                --resource myASG 
                --region ${AWS::Region}

      BlockDeviceMappings:
        - DeviceName: /dev/xvda
          Ebs:
            DeleteOnTermination: "true"
            VolumeSize: 30
            VolumeType: gp2
      ImageId: ami-06e05a843071324d1 
      InstanceType: t2.small
      IamInstanceProfile: !Ref InstanceProfile
      KeyName: !Ref KeyName
      SecurityGroups:
          - Ref: wahajwebserver

  myASG:
    Type: AWS::AutoScaling::AutoScalingGroup
    CreationPolicy:
      ResourceSignal:
        Timeout: PT5M
        Count: !Ref DesiredCapacity
    Properties:
      #AutoScalingGroupName: myASG
      MinSize: !Ref MinSize
      MaxSize: !Ref MaxSize
      DesiredCapacity: !Ref DesiredCapacity
      HealthCheckGracePeriod: 300
      LaunchConfigurationName:
        Ref: ec2instance
      VPCZoneIdentifier:
        - !Ref SubnetA
        - !Ref SubnetB
      TargetGroupARNs:
        - !Ref DefaultTargetGroup

推荐答案

Myservice

Role: !Ref InstanceProfile

不正确. InstanceProfile仅用于ec2instance.

在没有角色的情况下尝试服务:

Try your service without the role:

  Myservice:
      Type: AWS::ECS::Service
      Properties: 
          Cluster: !Ref MyCluster        
          DeploymentController:   
              Type: ECS
          DesiredCount: 2
          LaunchType: EC2
          LoadBalancers: 
              - ContainerName: python
                ContainerPort: 8080
                TargetGroupArn: !Ref DefaultTargetGroup
          # Role: !Ref InstanceProfile # commented out
          SchedulingStrategy: REPLICA
          ServiceName: Python-service
          TaskDefinition: !Ref Task

ECS服务角色Myservice中的>不需要:

The ECS service role in Myservice shouldn't be required:

在为Amazon ECS引入服务链接角色之前，您需要为Amazon ECS服务创建IAM角色，该角色已向Amazon ECS授予了所需的权限. 不再需要此角色，但是如果需要，它可以使用.有关更多信息，请参阅Amazon ECS的旧版IAM角色.

Prior to the introduction of a service-linked role for Amazon ECS, you were required to create an IAM role for your Amazon ECS services which granted Amazon ECS the permission it needed. This role is no longer required, however it is available if needed. For more information, see Legacy IAM Roles for Amazon ECS.

更新:

在UserData中缺少\.应该是:

          /opt/aws/bin/cfn-signal -e $? \
                --stack ${AWS::StackName} \
                --resource myASG \
                --region ${AWS::Region}

这篇关于无法承担角色并验证指定的targetGroupArn.请确认所传递的ECS服务角色具有适当的权限的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！