允許ECS任務從Kinesis資料流中讀取-有解無憂

我正在通過 ECS 部署一個應用程式（FARGATE 是容量提供者）。我的應用程式需要訪問 Kinesis 流（已經存在并正在運行）。我無法弄清楚我需要提供的確切 IAM 假設政策。我在 Terraform 中有以下配置（已洗掉標簽、日志配置和專有名稱）。每次部署任務時，我都會收到一個錯誤，指出該任務無法承擔該角色。

我錯過了什么？

resource "aws_ecs_cluster" "cluster" {
  name = var.cluster_name
}

resource "aws_ecs_service" "service" {
  name            = var.service_name
  cluster         = aws_ecs_cluster.cluster.id
  task_definition = aws_ecs_task_definition.task.arn
  desired_count   = var.task_count
  launch_type     = var.task_launch_type

  load_balancer {
    target_group_arn = var.alb_target
    container_name   = "container"
    container_port   = 3000
  }

  network_configuration {
    subnets          = [for subnet in var.subnets : "${subnet}"]
    assign_public_ip = true
    security_groups  = [var.sg_id]
  }
}

resource "aws_ecs_task_definition" "task" {
  family = "task_family"

  container_definitions = file( var.container_definitions_json )

  requires_compatibilities    = ["FARGATE"]
  network_mode                = "awsvpc"
  memory                      = 1024
  cpu                         = 512

  execution_role_arn          = "${aws_iam_role.ecsTaskExecutionRole.arn}"

  task_role_arn               = "${aws_iam_role.ecsTaskRole.arn}"
}

resource "aws_iam_role" "ecsTaskRole" {
  name = "ecsTaskRole"
  assume_role_policy = "${data.aws_iam_policy_document.ecsTaskRole.json}"
  
}

data "aws_caller_identity" "current" {}

data "aws_partition" "current" {}

data "aws_region" "current" {}

data "aws_iam_policy_document" "ecsTaskRole" {
  statement {
    effect  = "Allow"
    actions = ["sts:AssumeRole"]
    principals {
      type = "AWS"
      identifiers = [
        format("arn:%s:iam::%s:root", data.aws_partition.current.partition, data.aws_caller_identity.current.account_id)
      ]
    }
  }
}

resource "aws_iam_role" "ecsTaskExecutionRole" {
  name               = "ecsTaskExecutionRole"
  assume_role_policy = "${data.aws_iam_policy_document.assume_role_policy.json}"
}

data "aws_iam_policy_document" "assume_role_policy" {
  statement {
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["ecs-tasks.amazonaws.com"]
    }
  }
}

resource "aws_iam_role_policy_attachment" "ecsTaskExecutionRole_policy" {
  role       = "${aws_iam_role.ecsTaskExecutionRole.name}"
  policy_arn = "arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy"
}

uj5u.com熱心網友回復：

這兩個角色都必須具有允許ecs-tasks.amazonaws.com.

請參見本檔案的任務角色，而這個檔案的執行角色。

轉載請註明出處，本文鏈接：https://www.uj5u.com/net/346703.html

標籤：亚马逊网络服务地形亚马逊亚马逊-ecs 亚马逊运动

上一篇：復制時更改快照名稱的AWSRDSAPI命令

下一篇：在Java中本地使用DynamoDB時，為什么會出現“無法加載AWS憑證”？