CloudFormation을 통해 ECS 서비스를 만들 수 없습니다.

Question

다음 CloudFormation 템플릿 파일을 만들어 ECS Cluster 및 TaskDefinition, Service를 만들었지 만 오류가 발생했습니다. 이 설정이 잘못 되었나요? 다음 템플릿을 사용하여 ECS 서비스를 만들 때

1. 는
2. Please verify that the ECS service role being passed has the proper permissions을 왔을 때, 속성 Role: !ImportValue "IAMRoleECSService"없이 템플릿을 생성 오류가 발생하지 않지만, CREATE_IN_PROGRESS

---

ECSApplicationService: 
    Type: "AWS::ECS::Service" 
    DependsOn: 
    - "ECSApplicationCluster" 
    - "ECSApplicationTaskDefinition" 
    Properties: 
    Cluster: !Ref "ECSApplicationCluster" 
    DeploymentConfiguration: 
     MaximumPercent: 100 
     MinimumHealthyPercent: 50 
    DesiredCount: 4 
    LoadBalancers: 
     - ContainerName: !Ref "ContainerAppName" 
     ContainerPort: 80 
     TargetGroupArn: !ImportValue "ALBTargetGroup" 
    Role: !ImportValue "IAMRoleECSService" 
    ServiceName: "ecs-application-service" 
    TaskDefinition: !Ref "ECSApplicationTaskDefinition" 

IAMRoleECSService: 
    Type: "AWS::IAM::Role" 
    Properties: 
    RoleName: "ecs-service" 
    AssumeRolePolicyDocument: 
     Version: "2012-10-17" 
     Statement: 
     - Effect: "Allow" 
      Principal: 
      Service: 
       - "ecs.amazonaws.com" 
      Action: 
      - "sts:AssumeRole" 
    Policies: 
     - PolicyName: "ec2-management" 
     PolicyDocument: 
      Version: "2012-10-17" 
      Statement: 
      - Effect: "Allow" 
       Action: 
       - "ec2:AuthorizeSecurityGroupIngress" 
       - "ec2:Describe*" 
       Resource: "*" 
     - PolicyName: "alb-management" 
     PolicyDocument: 
      Version: "2012-10-17" 
      Statement: 
      - Effect: "Allow" 
       Action: 
       - "elasticloadbalancing:DeregisterInstancesFromLoadBalancer" 
       - "elasticloadbalancing:DeregisterTargets" 
       - "elasticloadbalancing:DescribeTargetGroups" 
       - "elasticloadbalancing:DescribeTargetHealth" 
       - "elasticloadbalancing:Describe*" 
       - "elasticloadbalancing:RegisterInstancesWithLoadBalancer" 
       - "elasticloadbalancing:RegisterTargets" 
       Resource: "*" 

에서 완료되지 않습니다

어떻게해야합니까?

Answer 1

이제 ECS는 일반 역할 대신 Service-Linked Roles을 사용합니다. 다음을 사용하여 계정을 생성했는지 확인하십시오 : 그것은 더 이상 필요한로

aws iam create-service-linked-role --aws-service-name ecs.amazonaws.com

이 그런 다음 IAMRoleECSService에서 Role 매개 변수를 제거하지 않습니다.