无法代入角色并验证指定的 targetGroupArn。请验证正在传递的 ECS 服务角色是否具有适当的权限

Question

我正在尝试创建集群、服务和任务。错误发生在 Myservice 中，因为它说 Unable to assume role and validate the specified targetGroupArn. Please verify that the ECS service role being passed has the proper permissions. 我做错了什么？我没有附上所有相关文件，我只是提供了我认为发生错误的 yml 文件。
role.yml

---
AWSTemplateFormatVersion: 2010-09-09 
Resources:

  ExRole:
      Type: 'AWS::IAM::Role'
      Properties:
        AssumeRolePolicyDocument:
          Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Principal:
                Service:
                  - ecs-tasks.amazonaws.com
              Action:
                - 'sts:AssumeRole'
        Path: /
        ManagedPolicyArns:
          - arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy
        Policies: 
          - PolicyName: AccessECR
            PolicyDocument:
              Version: '2012-10-17'
              Statement:
                - Effect: Allow
                  Action: 
                    - ecr:BatchGetImage
                    - ecr:GetAuthorizationToken
                    - ecr:GetDownloadUrlForLayer 
                  Resource: '*'

  ContainerInstanceRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'               
        Statement:
          - Effect: Allow
            Principal: 
                Service: 
                    - ec2.amazonaws.com
            Action: 
                - sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceforEC2Role
      Path: '/'

  InstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties: 
      Roles: 
        - !Ref ContainerInstanceRole      

Outputs:
  
  ExRole:
    Description: Task excution role
    Value: !Ref ExRole
    Export:
        Name: "ExRole"
  InstanceProfile:
    Description: profile for container instances
    Value: !Ref InstanceProfile
    Export:
        Name: "InstanceProfile"            

Clusterandservice.yml

---
AWSTemplateFormatVersion: 2010-09-09

Parameters:

  KeyName:
    Type: AWS::EC2::KeyPair::KeyName
    Default: wahaj(webserver)

  DesiredCapacity:
    Type: Number
    Default: 2

  MinSize:
    Type: Number
    Default: 1

  MaxSize:
    Type: Number
    Default: 4  

  InstanceProfile:
    Type: String

  DefaultTargetGroup:
    Type: String

  Task:
    Type: String

  Albsg:
    Type: String

  VpcID:
    Type: String

  SubnetA:
    Type: String
      
  SubnetB:
    Type: String


Resources:

  MyCluster:
      Type: AWS::ECS::Cluster
      Properties: {}

  wahajwebserver:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupName: wahaj-webserver
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 22
          ToPort: 22
          CidrIp: 0.0.0.0/0
        - IpProtocol: tcp
          FromPort: 0
          ToPort: 65535
          SourceSecurityGroupId: !Ref Albsg
          Description: For traffic from Internet
      GroupDescription: Security Group for demo server
      VpcId: !Ref VpcID

  Myservice:
      Type: AWS::ECS::Service
      Properties: 
          Cluster: !Ref MyCluster        
          DeploymentController:   
              Type: ECS
          DesiredCount: 2
          LaunchType: EC2
          LoadBalancers: 
              - ContainerName: python
                ContainerPort: 8080
                TargetGroupArn: !Ref DefaultTargetGroup
          Role: !Ref InstanceProfile
          SchedulingStrategy: REPLICA
          ServiceName: Python-service
          TaskDefinition: !Ref Task

  ec2instance:
    Type: AWS::AutoScaling::LaunchConfiguration
    Properties:
      UserData:
        Fn::Base64: !Sub |
          #!/bin/bash -xe

          yum update -y && yum install -y aws-cfn-bootstrap 

          echo ECS_CLUSTER=${MyCluster} >> /etc/ecs/ecs.config
          echo ECS_BACKEND_HOST= >> /etc/ecs/ecs.config           

          /opt/aws/bin/cfn-signal -e $? \
                --stack ${AWS::StackName} \
                --resource myASG 
                --region ${AWS::Region}

      BlockDeviceMappings:
        - DeviceName: /dev/xvda
          Ebs:
            DeleteOnTermination: "true"
            VolumeSize: 30
            VolumeType: gp2
      ImageId: ami-06e05a843071324d1 
      InstanceType: t2.small
      IamInstanceProfile: !Ref InstanceProfile
      KeyName: !Ref KeyName
      SecurityGroups:
          - Ref: wahajwebserver

  myASG:
    Type: AWS::AutoScaling::AutoScalingGroup
    CreationPolicy:
      ResourceSignal:
        Timeout: PT5M
        Count: !Ref DesiredCapacity
    Properties:
      #AutoScalingGroupName: myASG
      MinSize: !Ref MinSize
      MaxSize: !Ref MaxSize
      DesiredCapacity: !Ref DesiredCapacity
      HealthCheckGracePeriod: 300
      LaunchConfigurationName:
        Ref: ec2instance
      VPCZoneIdentifier:
        - !Ref SubnetA
        - !Ref SubnetB
      TargetGroupARNs:
        - !Ref DefaultTargetGroup

Answer 1

以下Myservice

Role: !Ref InstanceProfile

不正确。 InstanceProfile 仅适用于 ec2instance.

在没有角色的情况下尝试您的服务：

  Myservice:
      Type: AWS::ECS::Service
      Properties: 
          Cluster: !Ref MyCluster        
          DeploymentController:   
              Type: ECS
          DesiredCount: 2
          LaunchType: EC2
          LoadBalancers: 
              - ContainerName: python
                ContainerPort: 8080
                TargetGroupArn: !Ref DefaultTargetGroup
          # Role: !Ref InstanceProfile # commented out
          SchedulingStrategy: REPLICA
          ServiceName: Python-service
          TaskDefinition: !Ref Task

Myservice 中的 ECS service role 不应该是必需的：

Prior to the introduction of a service-linked role for Amazon ECS, you were required to create an IAM role for your Amazon ECS services which granted Amazon ECS the permission it needed. This role is no longer required, however it is available if needed. For more information, see Legacy IAM Roles for Amazon ECS.

更新：

UserData 中缺少 \。应该是：

          /opt/aws/bin/cfn-signal -e $? \
                --stack ${AWS::StackName} \
                --resource myASG \
                --region ${AWS::Region}