ECS CLI - 您不能为需要服务相关角色的服务指定 IAM 角色

Question

我正在尝试通过 aws cli 将容器部署到 ECS（Fargate）。我能够成功创建任务定义，当我想向 Fargate 集群添加新服务时出现问题。

这是执行的命令：

aws ecs create-service --cli-input-json file://aws_manual_cfn/ecs-service.json

这是我得到的错误：

An error occurred (InvalidParameterException) when calling the CreateService operation: You cannot specify an IAM role for services that require a service linked role.`

ecs-service.json

{
"cluster": "my-fargate-cluster",
"role": "AWSServiceRoleForECS",
"serviceName": "dropinfun-spots",
"desiredCount": 1,
"launchType": "FARGATE",
"networkConfiguration": {
    "awsvpcConfiguration": {
        "assignPublicIp": "ENABLED",
        "securityGroups": ["sg-06d506f7e444f2faa"],
        "subnets": ["subnet-c8ffcbf7", "subnet-1c7b6078", "subnet-d47f7efb", "subnet-e704cfad", "subnet-deeb43d1", "subnet-b59097e8"]
     }
},
"taskDefinition": "dropinfun-spots-task",
"loadBalancers": [
    {
        "targetGroupArn": "arn:aws:elasticloadbalancing:us-east-1:************:targetgroup/dropinfun-spots-target-group/c21992d4a411010f",
        "containerName": "dropinfun-spots-service",
        "containerPort": 80
    }
]
}

任务定义.json

{
"family": "dropinfun-spots-task",
"executionRoleArn": "arn:aws:iam::************:role/aws-service-role/ecs.amazonaws.com/AWSServiceRoleForECS",
"memory": "0.5GB",
"cpu": "256",
"networkMode": "awsvpc",
"requiresCompatibilities": [
  "FARGATE"
],
"containerDefinitions": [
  {
    "name": "dropinfun-spots-service",
    "image": "************.dkr.ecr.us-east-1.amazonaws.com/dropinfun-spots-service:latest",
    "memory": 512,
    "portMappings": [
        {
          "containerPort": 80
        }
      ],
    "essential": true
  }
]
}

关于如何管理此链接角色错误的任何想法？

Answer 1

由于您尝试创建 Fargate 启动类型任务，因此您在任务定义中将网络模式设置为 awsvpc 模式（Fargate 仅支持 awsvpc 模式）。

在您的 ecs-service.json 中，我可以看到它有"role": "AWSServiceRoleForECS". 您似乎正在尝试为此服务分配服务角色。AWS 不允许您为需要服务相关角色的服务指定 IAM 角色。

如果您因为要使用负载均衡器而分配了服务 IAM 角色，则可以将其删除。因为使用 awsvpc 网络模式的任务定义使用服务相关角色，它是自动为您创建的[1]。

https://docs.aws.amazon.com/AmazonECS/latest/developerguide/using-service-linked-roles.html#create-service-linked-role