`aws ecsexecute-command` 导致 `TargetNotConnectedException` `由于内部错误，执行命令失败`

Question

我正在 ECS 集群上运行 Docker 映像，以对其进行 shell 并运行一些简单的测试。但是当我运行这个时：

aws ecs execute-command  \
  --cluster MyEcsCluster \
  --task $ECS_TASK_ARN \
  --container MainContainer \
  --command "/bin/bash" \
  --interactive

我收到错误：

The Session Manager plugin was installed successfully. Use the AWS CLI to start a session.


An error occurred (TargetNotConnectedException) when calling the ExecuteCommand operation: The execute command failed due to an internal error. Try again later.

我可以确认任务+容器+代理都在运行：

aws ecs describe-tasks \
  --cluster MyEcsCluster \
  --tasks $ECS_TASK_ARN \
  | jq '.'

aws ecs execute-command  \
  --cluster MyEcsCluster \
  --task $ECS_TASK_ARN \
  --container MainContainer \
  --command "/bin/bash" \
  --interactive

我使用 CDK Typescript 代码定义 ECS 集群和任务定义：

The Session Manager plugin was installed successfully. Use the AWS CLI to start a session.


An error occurred (TargetNotConnectedException) when calling the ExecuteCommand operation: The execute command failed due to an internal error. Try again later.

Answer 1

ECS Exec Checker应该能够找出您的设置出了什么问题。你能尝试一下吗？

check-ecs-exec.sh 脚本允许您通过代表您调用各种 AWS API 来检查和验证您的 CLI 环境和 ECS 集群/任务是否已为 ECS Exec 做好准备。

Answer 2

基于@clay 的评论

我也缺少ssmmessages:*权限。

https://docs.aws.amazon.com/AmazonECS/latest/developerguide/ecs-exec.html#ecs-exec-required-iam-permissions表示诸如

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ssmmessages:CreateControlChannel",
                "ssmmessages:CreateDataChannel",
                "ssmmessages:OpenControlChannel",
                "ssmmessages:OpenDataChannel"
            ],
            "Resource": "*"
        }
    ]
}

应该附加到您的“任务角色”中使用的角色（而不是“任务执行角色”），尽管唯一的ssmmessages:CreateDataChannel权限确实会削减它。

管理的政策

arn:aws:iam::aws:policy/AmazonSSMFullAccess
arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore
arn:aws:iam::aws:policy/AmazonSSMManagedEC2InstanceDefaultPolicy
arn:aws:iam::aws:policy/AWSCloud9SSMInstanceProfile

所有这些都包含必要的权限，AWSCloud9SSMInstanceProfile是最简约的。