使用负载均衡器部署ecs-cli fargate集群

Question

我正在尝试使用负载均衡器使用ecs-cli创建一个Fargate集群到目前为止，我想出了一个脚本来部署它，到目前为止，我的脚本是

building image
pushing it to ECR
echo ""
echo "creating task execution role"
aws iam wait role-exists --role-name $task_execution_role 2>/dev/null ||  aws iam --region $REGION create-role --role-name $task_execution_role 
--assume-role-policy-document file://task-execution-assume-role.json || return 1

echo ""
echo "adding AmazonECSTaskExecutionRole Policy"
aws iam --region $REGION attach-role-policy --role-name $task_execution_role 
--policy-arn arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy || return 1


echo ""
echo "creating task role"
aws iam wait role-exists --role-name $task_role 2>/dev/null ||  
aws iam --region $REGION create-role --role-name $task_role 
--assume-role-policy-document file://task-role.json 
echo ""
echo "adding AmazonS3ReadOnlyAccess Policy"
aws iam --region $REGION attach-role-policy --role-name $task_role 
--policy-arn arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess  || return 1


echo ""
echo "configuring cluster"
ecs-cli configure --cluster $CLUSTER --default-launch-type FARGATE --config-name $CLUSTER --region $REGION || return 1
ecs-cli down --force --cluster-config $CLUSTER --ecs-profile $profile_name || return 1

ecs-cli up --force --cluster-config $CLUSTER --ecs-profile $profile_name  || return 1

echo ""
echo "adding ingress rules to security groups"
aws ec2 authorize-security-group-ingress --group-id $SGid --protocol tcp 
--port 80 --cidr 0.0.0.0/0 --region $REGION || return

ecs-cli compose --project-name $SERVICE_NAME service up --create-log-groups 
--cluster-config $CLUSTER --ecs-profile $profile_name

ecs-cli compose --project-name $SERVICE_NAME service ps 
--cluster-config $CLUSTER --ecs-profile $profile_name
aws ec2 describe-instances --query 'Reservations[].Instances[].[InstanceId,InstanceType,PublicIpAddress,Tags[?Key==`Name`]| [0].Value]' --output table

这工作。服务已经启动，我可以从公共ip访问它。

我现在想添加一个负载均衡器所以我可以用route53

暴露一个DNS遵循其他几个问题的建议(特别是这一个)

I came up with this

echo ""
echo "configuring cluster"
ecs-cli compose --project-name $CLUSTER create
ecs-cli configure --cluster $CLUSTER --default-launch-type FARGATE --config-name $CLUSTER --region $REGION 

echo ""
echo "creating a new AWS CloudFormation stack called amazon-ecs-cli-setup-"$CLUSTER

ecs-cli up --force --cluster-config $CLUSTER --ecs-profile $profile_name 
echo "create elb & add a dns CNAME for the elb dns"
aws elb create-load-balancer --load-balancer-name $SERVICE_NAME --listeners Protocol="TCP,LoadBalancerPort=8080,InstanceProtocol=TCP,InstancePort=80" --subnets $subnet1 $subnet2 --security-groups $SGid --scheme internal
echo "create service with above created task definition & elb"
aws ecs create-service 
--cluster $CLUSTER 
--service-name ecs-simple-service-elb 
--cli-input-json file://ecs-simple-service-elb.json


ecs-cli compose --project-name $SERVICE_NAME service up --create-log-groups 
--cluster-config $CLUSTER --ecs-profile $profile_name
echo ""
echo "here are the containers that are running in the service"
ecs-cli compose --project-name $SERVICE_NAME service ps --cluster-config $CLUSTER --ecs-profile $profile_name

和我得到以下错误消息:

create elb & add a dns CNAME for the elb dns
An error occurred (InvalidParameterException) when calling the CreateService operation: Unable to assume role and validate the listeners configured on your load balancer. Please verify that the ECS service role being passed has the proper permissions.
INFO[0002] Using ECS task definition                     TaskDefinition="dashboard:4"
WARN[0003] Failed to create log group dashboard-ecs in us-east-1: The specified log group already exists
INFO[0003] Auto-enabling ECS Managed Tags
ERRO[0003] Error creating service                        error="InvalidParameterException: subnet cannot be blank." service=dashboard
INFO[0003] Created an ECS service                        service=dashboard taskDefinition="dashboard:4"
FATA[0003] InvalidParameterException: subnet cannot be blank.

here are the containers that are running in the service
Name                                            State                  Ports       TaskDefinition  Health
dashboard/4d0ebb65b20e4010b93cb99fb5b9e21d/web  STOPPED ExitCode: 137  80->80/tcp  dashboard:4     UNKNOWN

我的任务执行角色和任务角色附加了此策略

{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "",
"Effect": "Allow",
"Principal": {
"Service": "ecs-tasks.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}

我传递给创建服务的JSON是(从文档中复制):

{
"serviceName": "dashboard",
"taskDefinition": "dashboard",
"loadBalancers": [
{
"loadBalancerName": "dashboard",
"containerName": "dashboard",
"containerPort": 80
}
],
"desiredCount": 10,
"role": "ecsTaskExecutionRole"
}

我缺少哪些权限，我应该更改哪些权限?

Answer 1

IIRC，您的ECS服务角色应该具有AmazonEC2ContainerServiceRole角色权限，以访问您的ELB并验证侦听器。

见这里- https://aws.amazon.com/premiumsupport/knowledge-center/assume-role-validate-listeners/这里- https://docs.aws.amazon.com/AmazonECS/latest/developerguide/ecs_managed_policies.html#AmazonEC2ContainerServiceRole