By using AWS re:Post, you agree to the AWS re:Post Terms of Use
AWS re:Postre:Post

I'm executing the ECS task within the private subnets alongside the NAT gateway, but I'm encountering an error when attempting to retrieve values from the Secret Manager

0

I'm executing the ECS task within the private subnets alongside the NAT gateway. However, I encountered a 'Secret Manager retrieve value failed' error after creating the endpoint from ECS to Secret Manager, which resolved the issue. Surprisingly, when opting for the public subnet, the role alone suffices. My query pertains to why the ECS in the private subnet requires an endpoint connection to Secret Manager.

Topics
Networking & Content DeliveryContainersSecurity, Identity, & Compliance
Tags
Amazon VPCAmazon Elastic Container ServiceAWS Secrets Manager
Language
English
KARTHIK
asked 14 days ago114 views
1 Answer
0

It sounds like your Private subnet does not have a route to a NAT Gateway in a public Subnet.

profile picture
EXPERT
Gary Mclean
answered 14 days ago
  • KARTHIK
    14 days ago

    The private subnets also have a nat gateway

  • Gary Mclean EXPERT
    14 days ago

    What Subnet is the Nat Gateway on?

  • KARTHIK
    14 days ago

    Yes, If i using the custom policy in the ecs task-definition I getting the "ResourceInitializationError: unable to pull secrets or registry auth: execution resource retrieval failed: unable to retrieve secret from asm: service call has been retried 1 time(s): failed to fetch secret arn:aws:secretsmanager:us-east-2:117416794335:secret:SubscriptionApp/Stage/ENV-Credentials-3sS4z9 from secrets manager: AccessDeniedException: User: arn:aws:sts::117234594535:assumed-role/ecsTaskExecutionRole/0fdf743dd51140d2ac90866333e52bdc is not authorized to perform: secretsmanager:GetSecretValue on resource: arn:aws:secretsmanager:us-east-2:117416794335:secret:SubscriptionApp/1/env-Credentials-3sS4z9 because no identity-based policy allows the secretsmanager:GetSecretValue action status code: 400, request id: 1146aef6-1521-47a7-9644-0faabba028b1"

  • Gary Mclean EXPERT
    14 days ago

    Thanks for your error message.. Looks like a Policy issue then?

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions

Relevant content