ECS Fargate Task in EventBridge has ResourceInitializationError

Question

I have created an ECS Fargate Task, which I can manually run. It updates a Dynomodb and I get logs.

Now I want this to run on a schedule. I have setup a scheduled ECS task through EventBridge and through the UI in the ECS cluster. However, this does not run.

My looking at the EventBridge logs I can see that the container has been stopped for the following stopped reason:
```
ResourceInitializationError: unable to pull secrets or registry auth: execution resource retrieval failed: unable to retrieve ecr registry auth: service call has been retried 3 time(s): RequestError: send request failed caused by: Post https://api.ecr....
```
I thought this might be a problem with permissions. However, I tested giving the Task Execution Role full power user permissions and I still get the same error. Could the problem be something else?

Answer

There are two roles associated with a Fargate task: The [Task Role](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task-iam-roles.html), and the [Task Execution Role](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task_execution_IAM_role.html).

The Task Execution Role needs all the permissions needed to start the task, including pulling the container image from ECR, obtaining and decrypting any secrets needed to launch the container, and dispatching logs and telemetry data to CloudWatch. The container runtime runs in the Task Execution Role context.

The Task Role, on the other hand, needs all the permissions that are required by the task containers after launch. For example, if your application needs to access S3 or DynamoDB, the Task Role would contain those policies granting access to the application.

So it is important to distinguish those two roles: Task Execution role is used **before** launch; the Task Role is used **after** launch. It is possible that you associated the policies with the Task Role instead of the Task Execution role.

ECS Fargate Task in EventBridge has ResourceInitializationError

Relevant content