ECS TLS is not supported for services in short arn format
I have this issue where one of our services started throwing update errors all of a sudden without us chanigng anything in the service configuration. I can mention that we have had the same issue in our beta environment (eu-central-1), where we fixed it by deleting the ECS service and the CloudMap entries created by the Service Connect integration, but we're now facing the same issue in the production environment (eu-west-1) as well, and recreating the service with downtime is not an option unfortunately. None of the Service Connect ports have traffic encryption enabled and we've used this configuration for the better part of 1.5 years now. I'm only looking to update the service using a newer task definition, but also keep using Service Connect. I've also tried disabling and re enabling ServiceConnect and had no success. I also tried using the API, as we usually do things in automated scripts and also in the console UI, with the same result.
I understand the TLS restriction for short ARN services, but I don't want to use TLS for Service Connect.
- Newest
- Most votes
- Most comments
The issue you're experiencing is not directly related to TLS support for ECS services with short ARNs. The error message you're seeing suggests that there's a problem with the Service Connect configuration, specifically related to the service ARN format.
ECS services created before a certain date may have short ARNs, which are not compatible with some newer features, including certain aspects of Service Connect. While you're not trying to enable TLS for Service Connect, the system is still checking for compatibility with all Service Connect features during the update process.
To resolve this issue without recreating the service, you can try the following steps:
- Temporarily disable Service Connect for the ECS service.
- Update the service with the new task definition.
- Re-enable Service Connect after the update is successful.
If this doesn't work, you may need to migrate your service to the new ARN format. AWS provides a process for opting in to the new ARN format for existing services. This can typically be done without service downtime, but it should be carefully planned and tested in a non-production environment first.
To opt in to the new ARN format:
- Ensure your AWS CLI, SDKs, and tools are updated to the latest versions.
- Use the AWS CLI or SDK to opt in to the new ARN format for your account in the specific region.
- Once opted in, update your ECS service. This should automatically migrate the service to the new ARN format.
After migrating to the new ARN format, you should be able to update your service and use Service Connect without encountering the error you're seeing.
Remember to test this process thoroughly in a staging environment before applying it to your production services. If you're still encountering issues after trying these steps, it may be best to contact AWS support for further assistance, as they can provide more specific guidance based on your account and service configuration.
Sources
ECS Service using ServiceConnect with TLS error response on http request to itself | AWS re:Post
Using Service Connect TLS to make https connection between ALB and ECS Fargate | AWS re:Post
Hello Vlad!
The error shared was the following:
TLS is not supported for services in short arn format
Short ARN format is related to the previous ARN format used by the Amazon ECS. Please check this documentation to learn more about it.
You can also see further information (including the timelines and how to migrate) on this blog post.
In summary, it looks like this service was created before the announcement of the ARN change and, since there is no way to update the ARN format, you will need to create a new service to allow you to use the ECS Service Connect with TLS.
Hope this clarifies and helps you
This is not an acceptable answer. I would like to know what the Service Connect issues is, if it's not related to TLS. What newer features are not compatible? Disabling the ECS Service Connect will cause production downtime.