Fargate task stuck on Pending state

Question

Hello,
I've ceated an ECS service with private subnet (no internet access)
In the Task Definition, the role for image pull is the default predefined ECS rule.
In order to allow communication towards ECR, I've created ecr-api endpoint, ecr-dkr enpoint and an s3 endpoint gateway using the very same subnet used in the service.
The problem is that the Fargate service tasks are stuck in pending state.
If I create a service with the same Task Definition using a public subnet of the default VPC, everything is working well.
If I connect an instance to the private subnet I see that the ecr hostname is translated into local address.
What am I missing?

Answer

My problem was related to IAM.\
It appears that when working on a PrivateLink there's a need to attach the following policies to the ecsTaskExecutionRole Role:
- AmazonEC2ContainerRegistryReadOnly
- AmazonS3ReadOnlyAccess
It is recommended to customize the policies it and use specific resource of the relevant registry.

Fargate task stuck on Pending state

Relevant content