Terraform Fargate任务定义请求执行角色

Question

我正在使用Terraform在AWS中创建一些服务.其中一项服务是ECS任务定义.我按照文档操作,并不断收到以下错误:

aws_ecs_task_definition.github-backup: ClientException: Fargate requires task definition to have execution role ARN to support ECR images.
status code: 400, request id: 84df70ec-94b4-11e8-b116-97f92c6f483f

首先task_role_arn是可选的,我可以看到创建了一个新角色.我还尝试使用任务定义所需的权限创建一个角色.

这就是我所拥有的:

任务定义:

resource "aws_ecs_task_definition" "github-backup" {
  family                   = "${var.task_name}"
  requires_compatibilities = ["FARGATE"]
  network_mode             = "awsvpc"
  cpu                      = "${var.fargate_cpu}"
  memory                   = "${var.fargate_memory}"
  task_role_arn            = "${aws_iam_role.github-role.arn}"

  container_definitions = <<DEFINITION
[
    {
        "cpu": ${var.fargate_cpu},
        "image": "${var.image}",
        "memory": ${var.fargate_memory},
        "name": "github-backup",
        "networkMode": "awsvpc"
    }
]
DEFINITION
}

IAM政策:

resource "aws_iam_policy" "access_policy" {
  name = "github_policy"

  policy = <<EOF
{
    "Version": "2012-10-17",
    "Statement": [
    {
        "Sid": "Stmt1532966429082",
        "Action": [
        "s3:PutObject",
        "s3:PutObjectTagging",
        "s3:PutObjectVersionTagging"
        ],
        "Effect": "Allow",
        "Resource": "arn:aws:s3:::zego-github-backup11"
    },
    {
        "Sid": "Stmt1532967608746",
        "Action": "lambda:*",
        "Effect": "Allow",
        "Resource": "*"
    },
    {
        "Effect": "Allow",
        "Action": [
            "ecr:GetAuthorizationToken",
            "ecr:BatchCheckLayerAvailability",
            "ecr:GetDownloadUrlForLayer",
            "ecr:BatchGetImage",
            "logs:CreateLogStream",
            "logs:PutLogEvents"
            ],
            "Resource": "*"
        }
    ]
}
EOF
}

IAM角色:

resource "aws_iam_role" "github-role" {
  name = "github-backup"

  assume_role_policy = <<EOF
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": "sts:AssumeRole",
            "Principal": {
            "Service": [
                "s3.amazonaws.com",
                "lambda.amazonaws.com",
                "ecs.amazonaws.com"
            ]
            },
            "Effect": "Allow",
            "Sid": ""
        }
    ]
}
EOF
}

IAM政策附件:

resource "aws_iam_role_policy_attachment" "test-attach" {
    role       = "${aws_iam_role.github-role.name}"
    policy_arn = "${aws_iam_policy.access_policy.arn}"
}

Terraform计划不会向我显示任何错误.只有在运行Terraform时才会出现此错误.我提供了一个具有任务定义所需权限的角色,我仍然得到这个.这有什么问题？

Answer 1

如AWS ECS用户指南中所述, Fargate任务要求将执行角色指定为任务定义的一部分.

EC2启动类型任务不需要这样,因为EC2实例本身应具有IAM角色,允许它们提取容器映像并可选择将日志推送到Cloudwatch.

因为这对于EC2启动类型是可选的,所以Terraform需要使其成为可选项,否则会破坏它们.严格来说,Terraform没有办法在计划时进行跨领域验证,所以它无法在计划中告诉你因为你有一个Fargate启动类型任务,所以你需要指定execution_role_arn.有一些解决方法可以使用CustomizeDiff提供程序源代码,但它很糟糕,现在只在几个地方使用.

请注意,执行角色是启动任务所需的,而不是任务具有允许任务执行操作的角色.

因此,您应该从IAM策略中删除与ECS相关的权限,因为任务不应该与S3交互.而只需添加具有适当权限的角色作为执行角色.

要使用AWS托管的ECS任务执行角色,您可以执行以下操作:

data "aws_iam_role" "ecs_task_execution_role" {
  name = "ecsTaskExecutionRole"
}

resource "aws_ecs_task_definition" "github-backup" {
  family                   = "${var.task_name}"
  requires_compatibilities = ["FARGATE"]
  network_mode             = "awsvpc"
  cpu                      = "${var.fargate_cpu}"
  memory                   = "${var.fargate_memory}"
  task_role_arn            = "${aws_iam_role.github-role.arn}"
  execution_role_arn       = "${data.aws_iam_role.ecs_task_execution_role.arn}"

  container_definitions = <<DEFINITION
  [
    {
      "cpu": ${var.fargate_cpu},
      "image": "${var.image}",
      "memory": ${var.fargate_memory},
      "name": "github-backup",
      "networkMode": "awsvpc"
    }
  ]
  DEFINITION
}