ECS服务使用ALB的权限问题

Question

我正在尝试使用 cloudformation 部署带有 ALB 的 ECS 堆栈，但在创建服务时出现错误，这似乎是缺少访问负载均衡器的权限。

这是错误：Unable to assume role and validate the specified targetGroupArn. Please verify that the ECS service role being passed has the proper permissions.

这里是服务定义：

    "EcsService": {
      "Type":"AWS::ECS::Service",
      "DependsOn": [
        "loadBalancer",
        "EcsServiceRole"
      ],
      "Properties":{
        "Cluster":{
          "Ref": "EcsCluster"
        },
        "DesiredCount":"1",
        "DeploymentConfiguration":{
          "MaximumPercent":100,
          "MinimumHealthyPercent":0
        },
        "LoadBalancers": [
          {
            "ContainerName": "test-web",
            "ContainerPort": "80",
            "TargetGroupArn" : {
              "Ref": "loadBalancer"
            },
          }
        ],
        "Role":{
          "Ref": "EcsServiceRole"
        },
        "TaskDefinition":{
          "Ref": "runWebServerTaskDefinition"
        }
      }
    }

这里是负载均衡器的定义：

    "loadBalancer" : {
      "Type": "AWS::ElasticLoadBalancingV2::LoadBalancer",
      "Properties": {
        "Name": "testalb",
        "Scheme" : "internal",
        "Subnets" : [
          "subnet-b8217295",
          "subnet-ddaad2b8",
          "subnet-6d71fb51"
        ],
        "LoadBalancerAttributes" : [
          { "Key" : "idle_timeout.timeout_seconds", "Value" : "50" }
        ],
        "SecurityGroups": [
          { "Ref": "InstanceSecurityGroupOpenWeb" },
          { "Ref" : "InstanceSecurityGroupOpenFull" }
        ],
        "Tags" : [
          { "Key" : "key", "Value" : "value" },
          { "Key" : "key2", "Value" : "value2" }
        ]
      }
    }

这是服务应使用的 IAM 角色：

    "EcsServiceRole": {
      "Type":"AWS::IAM::Role",
      "Properties": {
        "AssumeRolePolicyDocument": {
          "Statement":[
            {
              "Effect":"Allow",
              "Principal":{
                "Service":[
                  "ecs.amazonaws.com"
                ]
              },
              "Action":[
                "sts:AssumeRole"
              ]
            }
          ]
        },
        "Path":"/",
        "Policies":[
          {
            "PolicyName":"ecs-service",
            "PolicyDocument":{
              "Statement":[
                {
                  "Effect":"Allow",
                  "Action":[
                    "elasticloadbalancing:*",
                    "ec2:*"
                  ],
                  "Resource":"*"
                }
              ]
            }
          }
        ]
      }
    }

我没有找到 IAM 中是否有 ALB 的特定命名空间。 你有什么想法吗？

Answer 1

TargetGroupArn 应该指向 TargetGroup ARN，而不是 ALB ARN，目前，它指向 Load Balancer ARN。

          "TargetGroupArn" : {
              "Ref": "loadBalancer"
            },

Answer 2

更新： 自 2018 年 7 月 19 日起，现在可以使用 CloudFormation https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-servicelinkedrole.html 创建 IAM 服务相关角色。

   EcsServiceLinkedRole:
    Type: "AWS::IAM::ServiceLinkedRole"
    Properties:
      AWSServiceName: "ecs.amazonaws.com"
      Description: "Role to enable Amazon ECS to manage your cluster."

---

旧答案： 由于 AWS 引入了Service-Linked Roles，我不再为我的AWS::ECS::Service 指定角色。它将默认为具有所有必要权限的服务相关角色。