8

我正在尝试通过 aws cli 将容器部署到 ECS（Fargate）。我能够成功创建任务定义，当我想向我的 Fargate 集群添加新服务时出现问题。

这是执行的命令：

aws ecs create-service --cli-input-json file://aws_manual_cfn/ecs-service.json

这是我得到的错误：

An error occurred (InvalidParameterException) when calling the CreateService operation: You cannot specify an IAM role for services that require a service linked role.`

ecs-service.json

{
"cluster": "my-fargate-cluster",
"role": "AWSServiceRoleForECS",
"serviceName": "dropinfun-spots",
"desiredCount": 1,
"launchType": "FARGATE",
"networkConfiguration": {
    "awsvpcConfiguration": {
        "assignPublicIp": "ENABLED",
        "securityGroups": ["sg-06d506f7e444f2faa"],
        "subnets": ["subnet-c8ffcbf7", "subnet-1c7b6078", "subnet-d47f7efb", "subnet-e704cfad", "subnet-deeb43d1", "subnet-b59097e8"]
     }
},
"taskDefinition": "dropinfun-spots-task",
"loadBalancers": [
    {
        "targetGroupArn": "arn:aws:elasticloadbalancing:us-east-1:************:targetgroup/dropinfun-spots-target-group/c21992d4a411010f",
        "containerName": "dropinfun-spots-service",
        "containerPort": 80
    }
]
}

任务定义.json

{
"family": "dropinfun-spots-task",
"executionRoleArn": "arn:aws:iam::************:role/aws-service-role/ecs.amazonaws.com/AWSServiceRoleForECS",
"memory": "0.5GB",
"cpu": "256",
"networkMode": "awsvpc",
"requiresCompatibilities": [
  "FARGATE"
],
"containerDefinitions": [
  {
    "name": "dropinfun-spots-service",
    "image": "************.dkr.ecr.us-east-1.amazonaws.com/dropinfun-spots-service:latest",
    "memory": 512,
    "portMappings": [
        {
          "containerPort": 80
        }
      ],
    "essential": true
  }
]
}

关于如何管理此链接角色错误的任何想法？

4

2 回答 2

8

由于您尝试创建 Fargate 启动类型的任务，因此您在任务定义中将网络模式设置为 awsvpc 模式（Fargate 仅支持 awsvpc 模式）。

在您的 ecs-service.json 中，我可以看到它具有"role": "AWSServiceRoleForECS". 您似乎正在尝试为此服务分配服务角色。AWS 不允许您为需要服务相关角色的服务指定 IAM 角色。

如果您因为要使用负载均衡器而分配了服务 IAM 角色，则可以将其删除。因为使用 awsvpc 网络模式的任务定义使用服务相关角色，它是自动为您创建的[1]。

https://docs.aws.amazon.com/AmazonECS/latest/developerguide/using-service-linked-roles.html#create-service-linked-role

于 2018-05-28T12:25:22.703 回答
1

而不是指定"role": "AWSServiceRoleForECS"

taskRoleArn您还可以指定executionRoleArn是否要为您的服务（容器）分配特定角色。如果您希望您的容器代表您访问其他 AWS 服务，这将非常有用。

任务定义.json

{
"family": "dropinfun-spots-task",
"executionRoleArn": "arn:aws:iam::************:role/aws-service-role/ecs.amazonaws.com/AWSServiceRoleForECS",
"taskRoleArn" : "here_you_can_define_arn_of_a_specific_iam_role"
"memory": "0.5GB",
"cpu": "256",
"networkMode": "awsvpc",
"requiresCompatibilities": [
  "FARGATE"
],
"containerDefinitions": [
  {
    "name": "dropinfun-spots-service",
    "image": "************.dkr.ecr.us-east-1.amazonaws.com/dropinfun-spots-service:latest",
    "memory": 512,
    "portMappings": [
        {
          "containerPort": 80
        }
      ],
    "essential": true
  }
]
}

注意：发布 aws account_id 是非常糟糕的做法："{

于 2019-06-26T07:00:38.837 回答