How do I troubleshoot CloudFormation error "Error occurred during operation 'CreateCluster SDK error: Service Unavailable. Please try again later."?

Short description

You might receive the following error due to a missing IAM service role, AWSServiceRoleForECS. This service linked role is created automatically when a cluster is launched via the ECS console. However, if the service is unable to create the service linked role due to explicit deny in the service control policy (SCP) the ECS CloudFormation stack fails with the above error.

Note: This issue usually occurs when you are creating the cluster for the first time in the account and the service role AWSServiceRoleForECS has not been created by ECS service.

Resolution

1. Ensure the IAM user/role who performed the ECS CreateCluster API has iam:CreateRole, iam:CreateServiceLinkedRole permissions.

2. Review the SCP policies attached to the account/OU and verify if the user/role has the required permissions to perform iam:CreateRole, iam:CreateServiceLinkedRole actions.

3. In order to create the "AWSServiceRoleForECS" service linked role manually and retry the cluster creation, you can run the below mentioned AWS CLI command to create the ECS service linked role.

aws iam create-service-linked-role --aws-service-name ecs.amazonaws.com

Currently AWS allows the creation of ECS Service Linked Role using the above AWS CLI command.

Related information

[+] Using service-linked roles for Amazon ECS

[+] Create a service-linked role

Co-author: Sanchi