0

I have created an ECS cluster linked to an Autoscaling group with an Application load balancer attached. The Autoscaling deploys the instances, the AMI is correctly choosen (ECS optimized).

for whatever reason the ecs instances are being deployed by the Auto Scaling service but are not registering with the ECS Cluster.

Does anybody have an idea, what could cause the error of not having the instances on my cluster?

1

Your EC2 instances just don't have enough permissions to register with ECS cluster:

Important

If you do not launch your container instance with the proper IAM permissions, your Amazon ECS agent cannot connect to your cluster.

Check IAM role that you've assigned to your EC2 instances. It should include appropriate permissions, for example:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ecs:DeregisterContainerInstance",
        "ecs:RegisterContainerInstance",
        "ecr:GetAuthorizationToken"
      ],
      "Resource": "*"
    }
  ]
}

Or you can use AWS-managed policy named AmazonEC2ContainerServiceforEC2Role and assigned it to your EC2 role.

More information is avalable at https://docs.aws.amazon.com/AmazonECS/latest/developerguide/instance_IAM_role.html.

| improve this answer | |
  • I have created a role called ecsServiceRole for my IAM user which has the policy attached, but still it is not working. – aerioeus Aug 3 '18 at 11:24
  • I was not talking about IAM policy for the user, I was talking about IAM policy for EC2 role. The fact that you have those permissions doesn't mean your EC2 instances have those permissions. – Sergey Kovalev Aug 3 '18 at 11:42
  • ok, but as far as know, I can only associate a role while creating the Auto Scaling group, which I did, the role is named ecsInstanceRole and contains the policy. I assume this is the correct way, right? – aerioeus Aug 3 '18 at 11:46
  • by the way, is there a way to let the Auto scaling deploy the instances to a specific cluster I have created before or will it generate a cluster like -default - of its own? – aerioeus Aug 3 '18 at 11:47
0

this one is also necessary to make it work; Amazon ECS needs permissions to register and deregister container instances with your load balancer when tasks are created and stopped

{
  "Version": "2008-10-17",
  "Statement": [
{
     "Sid": "",
     "Effect": "Allow",
     "Principal": {
     "Service": "ecs.amazonaws.com"
    },
    "Action": "sts:AssumeRole"
   }
 ]
}

https://docs.aws.amazon.com/AmazonECS/latest/developerguide/check-service-role.html

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.