允许 ECS 任务从 Kinesis 数据流中读取

Question

我正在通过 ECS 部署一个应用程序（FARGATE 是容量提供者）。我的应用程序需要访问 Kinesis 流（已经存在并且运行）。我无法弄清楚我需要提供的确切 IAM 假设策略。我在 Terraform 中有以下配置（删除标签、日志配置和专有名称）。每次部署任务时，我都会收到一条错误消息，指出该任务无法承担该角色。

我错过了什么？

resource "aws_ecs_cluster" "cluster" {
  name = var.cluster_name
}

resource "aws_ecs_service" "service" {
  name            = var.service_name
  cluster         = aws_ecs_cluster.cluster.id
  task_definition = aws_ecs_task_definition.task.arn
  desired_count   = var.task_count
  launch_type     = var.task_launch_type

  load_balancer {
    target_group_arn = var.alb_target
    container_name   = "container"
    container_port   = 3000
  }

  network_configuration {
    subnets          = [for subnet in var.subnets : "${subnet}"]
    assign_public_ip = true
    security_groups  = [var.sg_id]
  }
}

resource "aws_ecs_task_definition" "task" {
  family = "task_family"

  container_definitions = file( var.container_definitions_json )

  requires_compatibilities    = ["FARGATE"]
  network_mode                = "awsvpc"
  memory                      = 1024
  cpu                         = 512

  execution_role_arn          = "${aws_iam_role.ecsTaskExecutionRole.arn}"

  task_role_arn               = "${aws_iam_role.ecsTaskRole.arn}"
}

resource "aws_iam_role" "ecsTaskRole" {
  name = "ecsTaskRole"
  assume_role_policy = "${data.aws_iam_policy_document.ecsTaskRole.json}"
  
}

data "aws_caller_identity" "current" {}

data "aws_partition" "current" {}

data "aws_region" "current" {}

data "aws_iam_policy_document" "ecsTaskRole" {
  statement {
    effect  = "Allow"
    actions = ["sts:AssumeRole"]
    principals {
      type = "AWS"
      identifiers = [
        format("arn:%s:iam::%s:root", data.aws_partition.current.partition, data.aws_caller_identity.current.account_id)
      ]
    }
  }
}

resource "aws_iam_role" "ecsTaskExecutionRole" {
  name               = "ecsTaskExecutionRole"
  assume_role_policy = "${data.aws_iam_policy_document.assume_role_policy.json}"
}

data "aws_iam_policy_document" "assume_role_policy" {
  statement {
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["ecs-tasks.amazonaws.com"]
    }
  }
}

resource "aws_iam_role_policy_attachment" "ecsTaskExecutionRole_policy" {
  role       = "${aws_iam_role.ecsTaskExecutionRole.name}"
  policy_arn = "arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy"
}

Answer 1

两个角色都必须具有允许 ecs-tasks.amazonaws.com.

的信任策略

执行角色参见this document for the task role, and this document。

允许 ECS 任务从 Kinesis 数据流中读取

Allowing ECS Task to read from Kinesis data stream

amazon-web-services

amazon-ecs

amazon-iam

amazon-kinesis

terraform