AWS ECS Fargate - Task Not Running

Question

I followed this AWS Tutorial on setting up a task on AWS ECS Fargate https://docs.aws.amazon.com/AmazonECS/latest/userguide/ECS_AWSCLI_Fargate.html

I have an image in ECR, I have setup the Cluster and the Service, as well as the task definition and yet nothing, is running. I have to manually run the task in the aws console to get it to start and when I update the service with a new task definition the running task does not get updated even with a force deployment.

I wanted a very simple setup so I have no ELB or AutoScaling policy and the following setup for the service:

Number of tasks 1

Minimum healthy percent 100

Maximum percent 200

Deployment Type: Rolling Update

I feel like I am missing something, my task are not starting automatically and not updating upon service update.

I have attached below the deploy code I am using in my bitbucket pipeline if that helps at all:

    #!/bin/bash

    set -e

    # possible -b (base / app name) -i (image version), -e (deploy env) and -s (service id)
    while getopts b:i:e:s:r: option
    do
    case "${option}"
    in
    b) BASE_NAME=${OPTARG};;
    i) IMG_VERSION=${OPTARG};;
    e) DEPLOY_ENV=${OPTARG};;
    s) SERVICE_ID=${OPTARG};;
    r) EXECUTION_ROLE=${OPTARG};;
    esac
    done

    echo "BASE_NAME: " $BASE_NAME
    echo "IMG_VERSION: " $IMG_VERSION
    echo "DEPLOY_ENV: " $DEPLOY_ENV
    echo "SERVICE_ID: " $SERVICE_ID
    echo "EXECUTION_ROLE: " $EXECUTION_ROLE

    if [ -z "$BASE_NAME" ]; then
        echo "exit: No BASE_NAME specified"
        exit;
    fi

    if [ -z "$SERVICE_ID" ]; then
        echo "exit: No SERVICE_ID specified"
        exit;
    fi

    if [ -z "$DEPLOY_ENV" ]; then
        echo "exit: No DEPLOY_ENV specified"
        exit;
    fi

    if [ -z "$IMG_VERSION" ]; then
        echo "exit: No IMG_VERSION specified"
        exit;
    fi

    if [ -z "$EXECUTION_ROLE" ]; then
        echo "exit: No EXECUTION_ROLE specified"
        exit;
    fi

    # Define variables
    TASK_FAMILY=${BASE_NAME}-${DEPLOY_ENV}-${SERVICE_ID}
    SERVICE_NAME=${BASE_NAME}-${DEPLOY_ENV}-${SERVICE_ID}-service
    CLUSTER_NAME=${BASE_NAME}-${DEPLOY_ENV}-cluster

    IMAGE_PACEHOLDER="<IMAGE_VERSION>"

    CONTAINER_DEFINITION_FILE=$(cat ${BASE_NAME}-$SERVICE_ID.container-definition.json)
    CONTAINER_DEFINITION="${CONTAINER_DEFINITION_FILE//$IMAGE_PACEHOLDER/$IMG_VERSION}"


    export TASK_VERSION=$(aws ecs register-task-definition --family ${TASK_FAMILY} --container-definitions "$CONTAINER_DEFINITION" --requires-compatibilities '["FARGATE"]' --cpu "512" --memory "1024" --network-mode "awsvpc" --execution-role-arn ${EXECUTION_ROLE} | jq --raw-output '.taskDefinition.revision')
    echo "Registered ECS Task Definition: " $TASK_VERSION



    if [ -n "$TASK_VERSION" ]; then
        echo "Update ECS Cluster: " $CLUSTER_NAME
        echo "Service: " $SERVICE_NAME
        echo "Task Definition: " $TASK_FAMILY:$TASK_VERSION


        #Update ECS Service
        DEPLOYED_SERVICE=$(aws ecs update-service --cluster $CLUSTER_NAME --service $SERVICE_NAME --task-definition $TASK_FAMILY:$TASK_VERSION --force-new-deployment | jq --raw-output '.service.serviceName')

        echo "Deployment of $DEPLOYED_SERVICE complete"


    else
        echo "exit: No task definition"
        exit;
    fi

EDIT:

Here is my task definition:

    {
      "ipcMode": null,
      "executionRoleArn": "arn:aws:iam::<Account-id>:role/:arn:aws:iam::<Account-id>:role/ecsTaskExecutionRole",
      "containerDefinitions": [
        {
          "dnsSearchDomains": null,
          "logConfiguration": null,
          "entryPoint": [],
          "portMappings": [
            {
              "hostPort": 80,
              "protocol": "tcp",
              "containerPort": 80
            },
            {
              "hostPort": 443,
              "protocol": "tcp",
              "containerPort": 443
            }
          ],
          "command": [],
          "linuxParameters": null,
          "cpu": 0,
          "environment": [],
          "resourceRequirements": null,
          "ulimits": null,
          "dnsServers": null,
          "mountPoints": [],
          "workingDirectory": "/usr/share/nginx/html/",
          "secrets": null,
          "dockerSecurityOptions": null,
          "memory": null,
          "memoryReservation": null,
          "volumesFrom": [],
          "stopTimeout": null,
          "image": "<Account-id>.dkr.ecr.us-east-1.amazonaws.com/<my-ecr-image>:latest",
          "startTimeout": null,
          "dependsOn": null,
          "disableNetworking": null,
          "interactive": null,
          "healthCheck": null,
          "essential": true,
          "links": null,
          "hostname": null,
          "extraHosts": null,
          "pseudoTerminal": null,
          "user": null,
          "readonlyRootFilesystem": null,
          "dockerLabels": null,
          "systemControls": null,
          "privileged": null,
          "name": "dig-website"
        }
      ],
      "placementConstraints": [],
      "memory": "1024",
      "taskRoleArn": null,
      "compatibilities": [
        "EC2",
        "FARGATE"
      ],
      "taskDefinitionArn": "arn:aws:ecs:us-east-1:<Account-id>:task-definition/myapp-production-website:11",
      "family": "myapp-production-website",
      "requiresAttributes": [
        {
          "targetId": null,
          "targetType": null,
          "value": null,
          "name": "com.amazonaws.ecs.capability.docker-remote-api.1.17"
        },
        {
          "targetId": null,
          "targetType": null,
          "value": null,
          "name": "ecs.capability.execution-role-ecr-pull"
        },
        {
          "targetId": null,
          "targetType": null,
          "value": null,
          "name": "com.amazonaws.ecs.capability.docker-remote-api.1.18"
        },
        {
          "targetId": null,
          "targetType": null,
          "value": null,
          "name": "ecs.capability.task-eni"
        },
        {
          "targetId": null,
          "targetType": null,
          "value": null,
          "name": "com.amazonaws.ecs.capability.ecr-auth"
        }
      ],
      "pidMode": null,
      "requiresCompatibilities": [
        "FARGATE"
      ],
      "networkMode": "awsvpc",
      "cpu": "512",
      "revision": 11,
      "status": "ACTIVE",
      "proxyConfiguration": null,
      "volumes": []
    }

Answer 1

Solved my issue. The error originated from an argument I passed to my bitbucket pipeline.

I have an env variable in my pipeline to populate the execution role, what I did not know is that all I needed to pass to the aws cli for ecs register-task was the name of the role and not the full ARN like shown below:

"executionRoleArn": "arn:aws:iam::<Account-id>:role/:arn:aws:iam::<Account-id>:role/ecsTaskExecutionRole"

which should be instead:

 "executionRoleArn": "arn:aws:iam::<Account-id>:role/ecsTaskExecutionRole"

because it can't resolve the arn it will throw an error saying the role does not have the right permissions.