Questions tagged with AWS Fargate

In local, I was able to connect to the container through the docker exec command. However, fargate is a serverless service, so I wonder if it can connect to the container.

I want to make http requests from a running Lambda function to Fargate within the same region. What will the data transfer costs be?

I wanted to test whether Codedeploy can be deployed without ECS tasks, so I tested the ECS service with the task number set to 0. Contrary to expectations, CodeDeploy was successfully deployed with no tasks. If it was successfully deployed, it means that the content was properly distributed to the task. I wonder why it succeeded in the absence of the task. Below is the codedeploy result. [ECS image01](https://i.ibb.co/G0vTQ7L/ECS-codedeploy01.png) [ECS image02](https://i.ibb.co/7NJXmSn/ECS-codedeploy02.png)

I would like to deploy a multi tenant web application say `webapp.com` and I would like each customer to have their own subdomain like `app.customer1.webapp.com`, `api.customer1.webapp.com`, `app.customer2.webapp.com`, `api.customer2.webapp.com`, etc. This was each customer has their own API and Web App URL. I would like all web app urls to go to the same instance of the application but load a different configuration for each customer - each customer has their own cognito userpool. Similarly for API but I would need to authenticate based on Bearer Token and Domain used. For the backend I think I will have a dynamodb table to hold the details of each customer. The web app is NextJS app so I think I will use a fargate cluster for both the web app and api (I want to avoid API Gateway and lambda). I will also use CDK for all infrastructure so I might also use it to bootstrap each customer using a stack that consists of Route53 configs and other resources like userpool that is unique to each customer. What is the easiest way to achieve this (preferably with CDK) ?

I have a Lambda function that is supposed to pass its own permissions to the code running in an ECS task. It looks like this: ``` ecs_parameters = { "cluster": ..., "launchType": "FARGATE", "networkConfiguration": ..., "overrides": { "taskRoleArn": boto3.client("sts").get_caller_identity().get("Arn"), ... }, "platformVersion": "LATEST", "taskDefinition": f"my-task-definition-{STAGE}", } response = ecs.run_task(**ecs_parameters) ``` When I run this in Lambda, i get this error: ``` "errorMessage": "An error occurred (ClientException) when calling the RunTask operation: ECS was unable to assume the role 'arn:aws:sts::787364832896:assumed-role/my-lambda-role...' that was provided for this task. Please verify that the role being passed has the proper trust relationship and permissions and that your IAM user has permissions to pass this role." ``` If I change the task definition in ECS to use `my-lambda-role` as the task role, it works. It's specifically when I try to override the task role from Lambda that it breaks. The Lambda role has the `AWSLambdaBasicExecutionRole` policy and also an inline policy that grants it `ecs:runTask` and `iam:PassRole`. It has a trust relationship that looks like: ``` "Effect": "Allow", "Principal": { "Service": [ "ecs.amazonaws.com", "lambda.amazonaws.com", "ecs-tasks.amazonaws.com" ] }, "Action": "sts:AssumeRole" ``` The task definition has a policy that grants it `sts:AssumeRole` and `iam:PassRole`, and a trust relationship that looks like: ``` "Effect": "Allow", "Principal": { "Service": "ecs-tasks.amazonaws.com", "AWS": "arn:aws:iam::account-ID:role/aws-service-role/ecs.amazonaws.com/AWSServiceRoleForECS" }, "Action": "sts:AssumeRole" ``` How do I allow the Lambda function to pass the role to ECS, and ECS to assume the role it's been given? P.S. - I know a lot of these permissions are overkill, so let me know if there are any I can get rid of :) Thanks!

Hi, I follow AWS Blog to provision and expose service through Application Load Balancer (https://aws.amazon.com/blogs/compute/building-deploying-and-operating-containerized-applications-with-aws-fargate/). I found that after I follow the step, ECS service is provisioned, but when I tried to access from internet, it cannot be accessed, is there any way for me to trace it. Whether Application Load Balancer is not configure properly or what? Thank You.

Hello, i have some issue on SES, i send email with SES API v2 using nodejs, but i'm send file more than 10mb and then i'm got error InvalidParameterValue: Message length is more than 10485760 bytes. i'm reading what new aws https://aws.amazon.com/about-aws/whats-new/2022/04/amazon-ses-v2-supports-email-size-40mb-inbound-outbound-emails-default/ does anyone know this problem?

Overview: I'm trying to run an XGboost model on a bunch of parquet files sitting in S3 using dask by setting up a fargate cluster and connecting it to a Dask cluster. Total dataframe size totals to about 140 GB of data. I scaled up a fargate cluster with properties: Workers: 40 Total threads: 160 Total memory: 1 TB So there should be enough data to hold the data tasks. Each worker has 9+ GB with 4 Threads. I do some very basic preprocessing and then I create a DaskDMatrix which does cause the task bytes per worker to get a little high, but never above the threshold where it would fail. Next I run xgb.dask.train which utilizes the xgboost package not the dask_ml.xgboost package. Very quickly, the workers die and I get the error `XGBoostError: rabit/internal/utils.h:90: Allreduce failed`. When I attempted this with a single file with only 17MB of data, I would still get this error but only a couple workers die. Does anyone know why this happens since I have double the memory of the dataframe? ``` X_train = X_train.to_dask_array() X_test = X_test.to_dask_array() y_train = y_train y_test = y_test ``` dtrain = xgb.dask.DaskDMatrix(client,X_train, y_train) output = xgb.dask.train( client, {"verbosity": 1, "tree_method": "hist", "objective": "reg:squarederror"}, dtrain, num_boost_round=100, evals=[(dtrain, "train")])`

When creating a service in AWS Fargate, that runs 1000 tasks, if I create a second one, then it stops scaling at 1000 concurrent tasks between both. The service quota is 5000 but it seems that the limit is imposed by the "DiscoverInstances" Quota which is set at 1000. So if I understood correctly, if I request an increase of the DiscoverInstances quota to 3000, Fargate will be able to scale up to 3000? Or do I need to request an increase for other quotas? What is a reasonable number to request for that quota? I would like to run 100.000 concurrent tasks but don't know if it is too much to ask. Thank you.

I'm trying to use a boto3 ECS waiter to wait on a Fargate ECS task to complete. The vast majority of the time the waiter works as expected (waits for the task to reach the STOPPED status). However, sporadically the waiter will return a failure because a task is marked as missing. However, I can find the task itself in the cluster and cloudwatch logs for the task. When I first encountered this, I switched to using boto3 [`ecs.describe_tasks`](https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/ecs.html#ECS.Client.describe_tasks) method to see if I could get more information about what was happening. When the above situation occurs, descirbe_tasks returns something like: ``` {'tasks': [], 'failures': [\{'arn': 'arn:aws:ecs:us-west-2:21234567891011:task/something-something/dsfsadfasdhfasjklhdfkdsajhf', 'reason': 'MISSING'}], 'ResponseMetadata': \{'RequestId': sdkfjaskdjfhaskdjfhasd', 'HTTPStatusCode': 200, 'HTTPHeaders': {'x-amzn-requestid': 'sdkjfhsdkajhfksadhkjsadf', 'content-type': 'application/x-amz-json-1.1', 'content-length': '145', 'date': 'Fri, 06 May 2022 08:36:11 GMT'}, 'RetryAttempts': 0}} ``` I've looked at the [AWS Docs ](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/api_failures_messages.html) and the none of the scenarios outlined for `reason: MISSING` apply in my circumstance. I'm passing my cluster name as an argument to the call as well. Since this happens intermittently its difficult to troubleshoot. What does the MISSING status mean? What are the reasons why an API call to check on task status would return missing when the task exists?

I may be missing something, but it seems our fargate nodes aren't updating their AMI and Kubelet version. Fargate notes are 4.14.275-207.503.amzn2.x86_64 / v1.20.7-eks-135321, but our EC2 nodes are on 5.4.188-104.359.amzn2.x86_64 / v1.20.11-eks-f17b81. We are able to update EC2 nodes as the new versions become available and we are notified. The fargate nodes are recycled often as we deploy fairly regularly. It does seem we must have received SOME update as these clusters have been deployed since 2021, and 1.20.11 was released in March? Does anyone know why our fargate nodes won't update?

Scenario: * Using ECS Fargate to launch Tasks from a Task Definition ( the container is a Python Django container, running a management command if this matters) * Problem: Logs were empty in Cloudwatch for the task run (completely - no data at all, but the log groups and stream were created). * When running the container locally, stdout outputted the expected data After much research and trial and error, I found that using a ENTRYPOINT command with a shell script is the problem. If I were to switch this to run the container with just the raw cli command as the ENTRYPOINT, the logs show in CW as expected. What is the reasoning/problem for this, and is there a different/better way to find out what was going on here besides trial and error? This Doesn't Work (in docker) ``` ENTRYPOINT [ "/app/docker-entrypoint.sh" ] CMD ["run_management_command"] ``` ``` # docker-entrypoint.sh # code shortened for a little brevity, may have syntax errors shift exec python manage.py "$@" ``` This Works ( in docker) ``` CMD ["python", "manage.py", "run_management_command"] ``` Does the shell script / exec cause the AWS std out logger to become disassociated somehow?

I've created a docker image, pushed it into a private ECR Repository, and configured an AWS Batch cluster/queue/job definition. When I submit a job, it immediately goes to the *STARTING* state, and then fails with ``` ResourceInitializationError: unable to pull secrets or registry auth: execution resource retrieval failed: unable to retrieve ecr registry auth: service call has been retried 3 time(s): RequestError: send request failed caused by: Post https://api.ecr.us-west-2.amazonaws.com/: dial tcp 54.240.255.116:443: i/o timeout ``` This seems to be a problem with the container image not being pulled. My cluster has the following specs: * Fargate provision model * Default VPC * Default security group (allows all outbound traffic, but only inbound from the default SG) * Default subnets (4 subnets with a route to an internet gateway and a single ACL rule allowing all traffic) The job definition has an execution role with the managed policy `AmazonECSTaskExecutionRolePolicy` and has the "Public IP" option **disabled**. The network configuration seems to be enough to pull images from the internet, but I'm still getting the timeout error. Also, the IAM Role seems to have the relevant policies to authenticate with my private ECR. Can someone help me debug this?

Hello, I'd like to deploy SageMaker's built-in algorithm, BlazingText model on Fargate instead of Sagemaker endpoint. So, I tried to make an ECS task using BlazingText docker path. Here is my CDK code for it. const loadBalancedFargateService = new ecsPatterns.ApplicationLoadBalancedFargateService(this, 'Service', { memoryLimitMiB: 1024, desiredCount: 1, cpu: 512, taskImageOptions: { image: ecs.ContainerImage.fromRegistry("811284229777.dkr.ecr.us-east-1.amazonaws.com/blazingtext:1"), }, }); However, I got an error: CannotPullContainerError: inspect image has been retried 1 time(s): failed to resolve ref "811284229777.dkr.ecr.us-east-1.amazonaws.com/blazingtext:1": pulling from host 811284229777.dkr.ecr.us-east-1.amazonaws.com failed with status code [manifests 1]... Is it impossible to pull docker container of sagemaker built-in algorithm from ECS?

Is it possible for us to mount an AWS FSx for Windows File Server file share onto our ECS EC2 host? Today, we have an application hosted on a Linux server with those FSx file shares mounted directly. Now that we are attempting to containerize these applications, we've come across this potential roadblock. Is this possible with ECS on EC2? Or, better yet, is this possible with ECS on Fargate? Thank you!

Hello - I have a docker container that is setup as a Fargate task on an ECS cluster. Standalone this works fine. I have also setup two event rule to detect when an object is 'put' on an s3 bucket. Rule 1: posts a message to an SNS topic which is set to send me an email; Rule 2: Invoke ECS Fargate task. Both tasks appear to run, according to the event bridge monitoring. Rule 1 does indeed send an email. Rule 2, however never seems to invoke the ECS fargate task. Does anyone have ideas on what I am missing? Is there a permission or setting that needs to be added? Thank you...

My system connects to share brokers using REST APIs during trading hours. Each thread takes care of a user account. Based on the number of my users several threads have to run simulationsly. Each thread takes care of a user account with a share broker. Can I use AWS Batch service for this usecase? Or is it better to use several Amazon ec2s by calculating memory and processor requirements?

Hi all, I don't know what I've done in the Console, but I am no longer able to update a service with FARGATE containers. Note this is the "classic" experience and not the New ECS Experience. Under "Step 1: Configure service", there is a section "Task Placement" with Placement Templates=Custom, zero Strategies, and 1 Constraint=DistinctInstance. I left it as Custom but **deleted the Constraint**. When I try to save the service, I get a red error "Failed updating Service : Placement constraints are not supported with FARGATE launch type. Funny enough, when I go back to "Step 1: Configure service", the "Task Placement" section is not there. Any ideas? Do I need to attack this problem from the CLI? Thanks!

I have an image that binds to port 80 as a **non-root** user. I can run it locally (macOS Monterey, Docker Desktop 4.7.1) absolutely fine. When I try and run it as part of an ECS service on Fargate it fails as so: **Failed to bind to 0.0.0.0/0.0.0.0:80** **caused by SocketException: Permission denied** Fargate means I have to run the task in network mode `awsvpc` - not sure if that's related? Any views on what I'm doing wrong? The [best practices document](https://docs.aws.amazon.com/AmazonECS/latest/bestpracticesguide/bestpracticesguide.pdf) suggests that I should be running as non-root (p.83) and that under awsvpc it's reasonable to expose port 80 (diagram on p.23). FWIW here's a mildly cut down version the JSON from my task definition: ``` { "taskDefinitionArn": "arn:aws:ecs:us-east-1:<ID>:task-definition/mything:2", "containerDefinitions": [ { "name": "mything", "image": "mything:latest", "cpu": 0, "memory": 1024, "portMappings": [ { "containerPort": 80, "hostPort": 80, "protocol": "tcp" } ], "essential": true, "environment": [] } ], "family": "mything", "executionRoleArn": "arn:aws:iam::<ID>:role/ecsTaskExecutionRole", "networkMode": "awsvpc", "revision": 2, "volumes": [], "status": "ACTIVE", "requiresAttributes": [ { "name": "com.amazonaws.ecs.capability.logging-driver.awslogs" }, { "name": "ecs.capability.execution-role-awslogs" }, { "name": "com.amazonaws.ecs.capability.ecr-auth" }, { "name": "com.amazonaws.ecs.capability.docker-remote-api.1.19" }, { "name": "ecs.capability.execution-role-ecr-pull" }, { "name": "com.amazonaws.ecs.capability.docker-remote-api.1.18" }, { "name": "ecs.capability.task-eni" } ], "placementConstraints": [], "compatibilities": [ "EC2", "FARGATE" ], "runtimePlatform": { "operatingSystemFamily": "LINUX" }, "requiresCompatibilities": [ "FARGATE" ], "cpu": "256", "memory": "1024", "tags": [] } ```

I have an ECS Fargate service with a security group associated. This security group is only used by the Fargate service. If I decided to delete the service and the security group I'm having an error deleting the security group saying that the security group has some dependant objects. I get that this is due to the network interface created by the ECS service. What I would like to understand is how long it takes to AWS/ECS to clean these network interfaces after the services are deleted? I've tried to add a waiter after I delete the service waiting for the network interface to be gone but it is too variable and sometimes it can take more than 12 min!! Do I really need to wait until this network interface is gone to delete the security group? Is there another resource I can check to know that I can delete the security group? Is there a way to predict/make faster the deletion of the internal network interfaces created by ECS? It is quite annoying not having control over this.

I'm trying to find a way to mount a single settings file on an [EFS](https://aws.amazon.com/efs/) to one of my ECS fargate containers. I manage to mount an [entire diretory](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/tutorial-efs-volumes.html), but that's not what I need. I only need the one file to be mounted, as to not loose all the other files on the containers destination. According the documentation this is possible, as it says [here on the first line](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/bind-mounts.html): > With bind mounts, a **file **or directory on a host, such as an Amazon EC2 instance or AWS Fargate, is mounted into a container. But after trying all possible ways and searching the internet I have not find the solution to my problem. Any ideas?

Hi. I've got an unexpected error, I guess it's about timeout. Task takes time quite long. generally less than 1minute. There is no problem when it finish before 1 minute. But sometimes task takes more than 1 minute. Error occurs when it takes more than 1minute. Please see below. ``` [ec2-user@ip-000-00-0-00 ~]$ curl --location --request POST 'userid.ap-northeast-2.elb.amazonaws.com:port/service' -d "video.mp4" -o output.json -v Note: Unnecessary use of -X or --request, POST is already inferred. % Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0* Trying 172.31.74.35:5000... * Connected to loadbalancer.ap-northeast-2.elb.amazonaws.com (000.00.00.00) port 0000 (#0) > POST /service HTTP/1.1 > Host: userid.ap-northeast-2.elb.amazonaws.com:port > User-Agent: curl/7.79.1 > Accept: */* > Content-Length: 37 > Content-Type: application/x-www-form-urlencoded > } [37 bytes data] 100 37 0 0 0 37 0 0 --:--:-- 0:00:59 --:--:-- 0* Mark bundle as not supporting multiuse < HTTP/1.1 500 Internal Server Error < Date: Tue, 19 Apr 2022 01:45:23 GMT < Content-Type: application/octet-stream < Content-Length: 0 < Connection: keep-alive < Server: Python/3.7 aiohttp/3.7.4.post0 < 100 37 0 0 0 37 0 0 --:--:-- 0:01:00 --:--:-- 0 * Connection #0 to host loadbalancer.ap-northeast-2.elb.amazonaws.com left intactm left intact ``` With curl verbose option, I get 500 Internal Server Error at 0:00:59. How can I finish my task which takes more than 1minutes? I've tried - increasing Health check grace period for **ECS Service** - increasing idle timeout of **Load Balancer** - increasing timeout and interval of **Target group** - curl options (like keep-alive, max-time) My EC2 Instance - type : t2.micro - Amazon Linux My Service - Service type : REPLICA - Launch type : FARGATE My task in service - Network mode : awsvpc - Compatibilities : EC2, FARGATE - Requries compatibilities : FARGATE - EFS mounted - Docker Appreciate,

``` { "Comment": "A description of my state machine", "StartAt": "Batch SubmitJob", "States": { "Batch SubmitJob": { "Type": "Task", "Resource": "arn:aws:states:::batch:submitJob.sync", "Parameters": { "JobDefinition": "arn:aws:batch:us-east-1:XXXXXXXXXXX:job-definition/clientcopyjobdef:1", "JobQueue": "arn:aws:batch:us-east-1:XXXXXXXXXX:job-queue/copyclientjq", "ContainerOverrides": { "Command.$": [ "dotnet", "CopyClientJob.dll", "$.input" ] }, "JobName.$": "$.input" }, "End": true } } } ``` I was trying to create this state machine, it was working fine if I am passing command to JobDefinition directly, but here I am truing to override the command and want to pass command parameter from state input, so trying to pass like above code. For `"JobName.$": "$.input"` it is working but for ``` "Command.$": [ "dotnet", "CopyClientJob.dll", "$.input" ] ``` It is not working, the command is passing as it is to aws batch without trasforming the parameter, can someone help on this. Thanks

I'm getting this error when I try to connect to my Fargate ECS container using ECS Exec feature: ``` An error occurred (TargetNotConnectedException) when calling the ExecuteCommand operation: The execute command failed due to an internal error. Try again later. ``` The task's role was missing the SSM permissions, I added them, but the error persists. Below is the output of the [amazon-ecs-exec-checker](https://github.com/aws-containers/amazon-ecs-exec-checker) tool: ``` Prerequisites for check-ecs-exec.sh v0.7 ------------------------------------------------------------- jq | OK (/usr/bin/jq) AWS CLI | OK (/usr/local/bin/aws) ------------------------------------------------------------- Prerequisites for the AWS CLI to use ECS Exec ------------------------------------------------------------- AWS CLI Version | OK (aws-cli/2.2.1 Python/3.8.8 Linux/5.13.0-39-generic exe/x86_64.ubuntu.20 prompt/off) Session Manager Plugin | OK (1.2.295.0) ------------------------------------------------------------- Checks on ECS task and other resources ------------------------------------------------------------- Region : us-west-2 Cluster: removed Task : removed ------------------------------------------------------------- Cluster Configuration | Audit Logging Not Configured Can I ExecuteCommand? | arn:aws:iam::removed ecs:ExecuteCommand: allowed ssm:StartSession denied?: allowed Task Status | RUNNING Launch Type | Fargate Platform Version | 1.4.0 Exec Enabled for Task | OK Container-Level Checks | ---------- Managed Agent Status ---------- 1. RUNNING for "api-staging" ---------- Init Process Enabled (api-staging:14) ---------- 1. Enabled - "api-staging" ---------- Read-Only Root Filesystem (api-staging:14) ---------- 1. Disabled - "api-staging" Task Role Permissions | arn:aws:iam::removed ssmmessages:CreateControlChannel: allowed ssmmessages:CreateDataChannel: allowed ssmmessages:OpenControlChannel: allowed ssmmessages:OpenDataChannel: allowed VPC Endpoints | Found existing endpoints for vpc-removed: - com.amazonaws.us-west-2.s3 SSM PrivateLink "com.amazonaws.us-west-2.ssmmessages" not found. You must ensure your task has proper outbound internet connectivity. Environment Variables | (api-staging:14) 1. container "api-staging" - AWS_ACCESS_KEY: not defined - AWS_ACCESS_KEY_ID: defined - AWS_SECRET_ACCESS_KEY: defined ``` The output has only green and yellow markers, no red ones, which means Exec should work. But it doesn't. Any ideas why?

We are mounting EFS volume to our task and we are running the task on fargate but it giving above mentioned error. we made sure everything running the Fargate task and EFS is in the same VPC, using the same sub net and availability zone. We also opened port 2049 for NFS. We also tried opening all traffic for all ports and attached to the task but still we are facing the same issue.

I created ecs and service, and in the event tab, I could see the following phrase. (fargate) "service xxxx was unable to place a task because your account is currently blocked." It's the first time I've seen this phrase, and I'm not sure how to deal with it.

Hi, I am new to AWS Amplify and would like guidance on how to send a query to an ***existing*** GraphQL API on AWS AppSync. I am unsure how to start as a lot of Amplify coverage creates a *new* AppSync API using the Amplify CLI. ## Objectives * Set up a Node.js project to work with an existing AWS AppSync API, using AWS Amplify as the GraphQL client. * Send a single query to an existing AWS AppSync API. The query lists game results from a DynamoDB table and is called `listGames` in my GraphQL schema. * I need to repeat the query in order to fetch all available database records that satisfy the query. This would mean adding results to an array/object until the `nextToken` is `null` (i.e. no more records can be found for the query). ## Context * This application is deployed in an Amazon ECS container using AWS Fargate. * The ECS service is fronted by an Application Load Balancer (ALB). * A leader board web page fetches game results through a `POST` request to the ALB's DNS name / URL and adds them to a HTML table. ## Notes * For now, API key is my authentication method. I would soon like to switch to a task IAM role in ECS. * The ECS deployment described in 'Context' is working but it sends `POST` requests without AWS libraries. It is my understanding that I would need to use an AWS library in order to use an IAM role for AppSync authentication (used as a [task IAM role in ECS](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task-iam-roles.html)). Please correct me if I am mistaken. I would greatly appreciate any help you can give me. Thank you for your time!

I want to be able to have a step function that does the following: 1. The step function starts with a call to API Gateway from my web app 2. The step function starts a Fargate pod based on a specific image 3. The step function runs a task on the pod it just created 3. After the Fargate task completes, terminate the pod so it does not consume resources Is this possible to tell Step Functions to start a new pod based on a certain image and then terminate that pod after it returns a success code? I have not been able to find any info on this. Thank you

Successfully I ran execute-cmd via aws command on Fargate task instance. But my teammates are running into this error message. > Encountered error while initiating handshake. KMSEncryption failed on client with status 2 error: Failed to process action KMSEncryption: error while creating new KMS service, Error creating new aws sdk session LoadClientTLSCertError: client TLS cert(true) and key(false) must both be provided

How can we increase the internet speed of the container running in AWS ECS and later how can we verify that container internet speed is increased or not while downloading any dependencies on container or posting some data into S3 while working with JAR execution from the container etc. ?

Hi, I followed the wizard to create an ECS/fargate cluster and a basic step function state machine. I was able to run the state machine once (after working through a few permissions issues), though the container exited. I updated the task definition (specifically, all I changed was the container's entrypoint and command), and I'm now encountering a new IAM issue despite not (to my knowledge) changing anything related to the state machine or cluster's roles. ``` Error ECS.AccessDeniedException Cause User: arn:aws:sts::****:assumed-role/StepFunctions-hello-role-****/**** is not authorized to perform: ecs:RunTask on resource: arn:aws:ecs:us-west-2:****:task-definition/hello-task:2 because no identity-based policy allows the ecs:RunTask action (Service: AmazonECS; Status Code: 400; Error Code: AccessDeniedException; Proxy: null) ``` Is there a particular resource that needs to have this role/policy assigned that I'm missing? I don't know how to set or access permissions for "assumed roles" before or after the state machine runs. Thanks!

The team comprises of 4 developers who would be working on features parallelly. The resources being used are **EventBridge**, **ECS**, **Fargate** etc... My questions are: 1. Is there any framework and CLI available to create **EventBridge** and other resources locally on developers' laptop? 2. Should the developers use the same **EventBridge** from the AWS Environment during the development? This can create conflicts between developers if they share some code. 3. Should the developers create their own environment with **EventBridge** in their AWS account during development? This can avoid conflicts. 4. Should the developers use the same AWS environment but create their own resources with different names?

We want to run containers on an ec2 fargate cluster that will run jobs of an arbitrary duration (30 minutes on average). We want to scale out based on active TCP connection metrics via the AWS loadbalancer (1 tcp connection contains stream that needs to be handled by 1 container). This seems possible with cloudwatch metrics. The question is how to **scale in** once the job is done. We do not want to stop a container when it's still processing an active connection. It could take hours for the job to finish (and that is OK). Is there a way we can remove a container once it is done processing (aka no active tcp connection anymore?) If the process inside the container stops, is it removed from the desired active container total?

We have an EKS Cluster in ap-southeast-2 region. The Kubernetes version is 1.20 and the Platform version is eks.3. We want to restrict access to service to only certain Pods. For example, we have serviceA and serviceB, how would we configure a Pod so that Pod can only access to serviceA not serviceB? I know the `NetworkPolicy` can do the job, but as far as I know the `NetworkPolicy` resource requires Calico CNI which is not supported by EKS Fargate. EKS Fargate seems to offer `SecurityGroupPolicy` but I don't think there's a way to attach `SecurityGroupPolicy` to a Service.

I am creating this new question, because I could not post an answer on the already existing thread here https://repost.aws/questions/QUiWCpad5jReKxxTiWjKfeyA/how-to-solve-the-ecs-error-youve-reached-the-limit-on-the-number-of-tasks-you-can-run-concurrently I have the same problem as the user in the mentioned thread, but starting an EC2 instance (which I already had before) did not resolve the issue. I can only run 2 tasks concurrently in my ECS Fargate Cluster. The problem is, I don't really know which quota increase request I should choose. I tried `Tasks per service` but so far, I haven't got an answer. I am not sure, but I think there is a bug in the quota view because in the column `Applied quota value` every entry says `Not available` Also, I had to select 5001 as quota (1 above default) which does not make sense to me because I cannot even launch 2 tasks. Maybe someone can help me which this problem.

My web app processes photos on a large scale. A user might upload 20,000 images at once to be processed. I upload them to S3 and then process them. Like Lambda allows, I need to be able to trigger the processing of the photos via API Gateway, have multiple instances running at once that are isolated from each other, and when the instance is done running it stops with the ability to scale to 0 when there is no demand (like at night time) or scale to virtually unlimited if there are 10,000 that upload photos at the same time. Lambda would be perfect for this but with the 15 minute limit it will not work as some jobs could take up to 2 hours to finish. Is there another AWS service that would allow me to do what I need but not have the time limit? I looked into Fargate and Batch but they do not seem to really work for the requirements.

I have created an ECS Fargate Task, which I can manually run. It updates a Dynomodb and I get logs. Now I want this to run on a schedule. I have setup a scheduled ECS task through EventBridge and through the UI in the ECS cluster. However, this does not run. My looking at the EventBridge logs I can see that the container has been stopped for the following stopped reason: ``` ResourceInitializationError: unable to pull secrets or registry auth: execution resource retrieval failed: unable to retrieve ecr registry auth: service call has been retried 3 time(s): RequestError: send request failed caused by: Post https://api.ecr.... ``` I thought this might be a problem with permissions. However, I tested giving the Task Execution Role full power user permissions and I still get the same error. Could the problem be something else?

I need to run a container/code that will zip files from S3. I am zipping a lot of files so it could take up to 1 hour to zip all the files which means Lambda is not an option. This leaves me to use Fargate. However, based on my understanding, Fargate will have a pod running at all times. I want to use API Gateway that will "invoke" a Fargate pod, run the code, then terminate the pod when the files are done being zipped. That way each zip function will have its own isolated environment and I will only be charged for the time that I need to zip files and not all the time the pod is running. Is this possible and if so how would one go about it? Or is there another AWS service that would be better suited? Thank you

Hi all, A newbie here. I want to run a small personal Wordpress blog (more like a CV/portfolio page with little content) on AWS. I am interested in learning how Fargate/containers work, that's why I set myself a challenge to run this blog as a container rather than on EC2. I have configured Docker desktop and successfully run the WP container (based on WP and mySQL images) locally. Now my idea is that I need to deploy this container to AWS (Next steps to register a domain via Route 53, etc, but I am not concerned about it now). Questions: 1. I googled first, but most of the proposed solutions for running a Wordpress site in a container on AWS mention also using EC2/RDS/S3. Why? My understanding is that if I run both WP + MySQL in a container, I shouldn't need any other AWS services. --- 2. What would be the costs for running a simple container like that? In the Pricing Calculator one of the parameters is the length of the task, and I'm somewhat confused here. My idea is that I just start the container once and it keeps running till it fails for some reason, and then it just gets restarted. Thank you! Regards E

I'm attempting to startup an EKS pod following the getting started guide. When on the step add a Fargate Profile I'm getting the following error. > "Misconfigured PodExecutionRole Trust Policy; Please add the eks-fargate-pods.amazonaws.com Service Principal" However it's already added to my trust policy. So not sure what to do `{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "Service": "eks-fargate-pods.amazonaws.com" }, "Action": "sts:AssumeRole", "Condition": { "ArnLike": { "aws:SourceArn": "arn:aws:<region>:111122223333:fargateprofile/<pod name>/*" } } } ] }` I'm currently following this step. https://docs.aws.amazon.com/eks/latest/userguide/getting-started-console.html

A customer wants to get various flavors of logs from ECS on EC2, ECS on Fargate, API GW logs, load balancer logs, (and potentially RDS Aurora) to Splunk endpoint Following have already been referenced to the customer Splunk white paper: https://www.splunk.com/pdfs/white-papers/getting-data-into-gdi-splunk-from-aws.pdf  And a couple of these blog posts https://www.splunk.com/en_us/blog/it/splunking-aws-ecs-part-2-sending-ecs-logs-to-splunk.html https://www.splunk.com/en_us/blog/it/splunking-aws-ecs-and-fargate-part-3-sending-fargate-logs-to-splunk.html 
 The challenge is which approach to use as we they ECS Fargate and ECS on EC2 along with other AWS services for which they want to centralize their logs. Currently they are considering separate lambda functions for ECS, lambda for LBs etc. to pull logs from cloudwatch and push them to Splunk endpoint. Trying to seek suggestions on what could be the best practices.

I have an ECS Fargate Service in VPC, which has two private subnets. This service is accessible from the internet through a load balancer, which has public subnets in the same availability zones as the private subnets. The private subnets use a NAT gateway to route traffic to the public subnets. However, I am having issues connecting to a DocumentDB database from the service. The DocumentDB database is in the same VPC as the service. I also have a lambda which uses the exact same private subnets as the service. It can connect to the database without any issues. The service and the lambda use the same connection code. All security groups involved have a rule that allows all inbound and outbound traffic. The private subnets are routed to a NAT gateway which points to public subnets. I believe my issue is somehow related to the subnets. Does anyone have any ideas what I can do in order to connect to the database, without losing my ability to also expose the service to the internet through the load balancer?

Running a step function state machine accessing an AWS HttpApi to run a lambda using a docker container of ~3 GB size. Fails 20% of the time with #503 error, the rest of the time I get the exact results I expect. It's not a container warm up I believe. Logs for API and lambda (non-container and container) don't show any problems. I have maximized the step functions time out, the retries for the specific lambda, the memory for the lambda (10GB). I have also tried to ping the container and wait 30 seconds in the step functions to no avail. *** Edit: Should have mentioned concurrency for the API is at max (believe it is automatic for HttpApis) Any advice would be appreciated. I don't want to use ECS fargate due to cost and relative complexity. Thanks!

I am trying to automate Fargate AWS Batch jobs by means of AWS Cloudwatch Events. So far, so good. I am trying to run the same job definition with different configurations. I am able to set the batch job as a cloudwatch event target. I have learned how to use the Constant (JSON text) configuration to set a parameter of the job. Thus, I can set the name parameter successfully and the job runs. However, I am not able to also set the memory and cpu settings in the Cloudwatch event. I would like to use a larger machine for a a bigger port such as Singapore, without changing the job definition. After all, at the moment it still uses the default vpcu and memory settings of the job definition. ``` { "Parameters": {"name":"wilhelmshaven"}, "ContainerOverrides": { "Command": ["upload_to_day.py", "-port_name","Ref::name"], "resourceRequirements": [ {"type": "MEMORY", "value": "4096"}, {"type": "VCPU", "value": "2"} ] } } ``` Does any one know how to set the Constant (JSON text) configuration or input transformer correctly? Edit: If I try the same thing using the AWS CLI, I can achieve what I would like to do. ``` aws batch submit-job \ --job-name "run-wilhelmshaven" \ --job-queue "arn:aws:batch:eu-central-1:123666072061:job-queue/upload-raw-to-day-vtexplorer" \ --job-definition "arn:aws:batch:eu-central-1:123666072061:job-definition/upload-to-day:2" \ --container-overrides '{"command": ["upload_to_day.py", "-port_name","wilhelmshaven"], "resourceRequirements": [{"value": "2", "type": "VCPU"}, {"value": "4096", "type": "MEMORY"}]}' ```

I am trying to leverage Amazon ECS 64-bit ARM architecture for https://hub.docker.com/r/arm64v8/nginx and other **arm64** images. However, I am getting the error: "exec user process caused: exec format error" during service creation phase. Fargate **amd64** tasks with **amd64** images run without this issue. According to this article - https://docs.aws.amazon.com/AmazonECS/latest/userguide/ecs-arm64.html my configuration must support 64-bit ARM workloads: * Region: Asia Pacific (Tokyo) ap-northeast-1 * Fargate platform version: 1.4.0 * Docker compose ``` version: "3.9" services: nginx: image: "arm64v8/nginx" x-aws-policies: - "arn:aws:iam::aws:policy/AmazonSSMFullAccess" x-aws-cloudformation: Resources: NginxService: Properties: EnableExecuteCommand: true NginxTaskDefinition: Properties: RuntimePlatform: CpuArchitecture: "ARM64" OperatingSystemFamily: "LINUX" ```

I have a Fargate service with exec command enabled. When I ran "/bin/sh" into the container, there's this error from the docker container > seelog internal error: mkdir /usr/local/sessionmanagerplugin/logs/: permission denied /usr/local/ folder doesn't have sessionmanagerplugin folder.

I've created a Lambda (NodeJS) which triggers on a file being uploaded to an S3 bucket. The Lambda uses the ecs.runTask method in the AWS SDK (v2) to then create a Fargate task using a TaskDef which includes two containers to process the file being uploaded. The task is created in an ECS cluster with no services defined. My issue is that although I'm requesting only a single task to be created I'm always seeing two tasks being created. They both run and produce logs indicating they have processed the file which was uploaded (but I only want to process the file once). The CloudWatch logs for the Lambda appear normal with only details for one of the tasks being returned (with the taskArn of one of the created tasks). I've tried removing one of the containers from the TaskDef and get the same behaviour (ie. two tasks, each containing 1 container). I've tried updating the count of tasks to create to 3 and I get 6 tasks started (the Lambda logs show 3 taskARNs). (The duplicate tasks are always created within a second or two of when the first one is created.) If I create the task from the management console using the same setup, it only creates 1 task as expected. Any suggestions on what the issue might be or how to debug it further would be appreciated.

Hi, We successfully trigger fargate task through step function, Something like below: * Is there anyway to define the ephemeral storage size, cpu and memory within the container override section below? * Now, when we create fargate task, we set desire_count=0, min_count=0 and we have 0 instance always on (which is good, we don't want to always on instance). But how will max_count be treated? When we have more than max_count of concurrent step function running, will some step just hanged and waiting for the finishment of certain fargate task? Or throwing error? Thank you , in advance. "UncompressGranuleECS": { "Parameters": { "LaunchType": "FARGATE", "Cluster": "${module.cluster.ecs_cluster_name}", "TaskDefinition": "${local.fargateTaskARN}", "NetworkConfiguration": { "AwsvpcConfiguration": { "Subnets": ${jsonencode(var.subnet_ids)}, "AssignPublicIp": "DISABLED" } }, "Overrides": { "ContainerOverrides": [ { "Name":"dyen-cumulus-uncompress_granule-fargate", "Command": ["java", "-Xms7500M", "-Xmx7500M", "-jar", "/home/dockeruser/build/libs/my-jarfile.jar"], "Environment":[ { "Name":"region", "Value":"us-west-2" }, { "Name":"TASK_TOKEN", "Value.$":"$$.Task.Token" }, { "Name":"CMA_MESSAGE", "Value":"myjson:[]" } ] } ] } }, "Type": "Task", "HeartbeatSeconds": 1800, "Resource": "arn:aws:states:::ecs:runTask.waitForTaskToken", "Retry": [ { "ErrorEquals": [ "States.ALL" ], "IntervalSeconds": 10, "MaxAttempts": 0 } ], "Catch": [ { "ErrorEquals": [ "States.ALL" ], "ResultPath": "$.exception", "Next": "failureStep" } ], "Next": "MissingStep" },

Hi All! Im following this tutorial - https://aws.amazon.com/blogs/containers/building-http-api-based-services-using-aws-fargate/ It creates NAT gateways which I don't need (the endpoints still work when NATs were deleted). How can I prevent AWS to spin them up when using CDK? Thanks,

Hi Folks, I am working on a modernization project, which contains API and several executable jobs. Customer has configured these executable in windows scheduler and trigger these jobs via C# code inside the API in fire and forget manner. Some jobs are created in the form of workflow for which they have created seprate C# exe. also these jobs taking hours and days to execute. The tech stack is .Net 4.5 and SQL Server (Windows authentication). They want to use step functions to create workflow. The problem with legacy system is , it is executing requests one by one. The API sends the request which they are storing in DB and executables are picking these requests one by one and processing. We were planing to propose design using Step functions, Lambda and AWS batch for long running jobs but as lambda does not support .Net 45, it will require .Net core migration first. can you please suggest good design for this?

I am testing out the Unity Fargate serverless solution at github link https://github.com/aws-samples/fargate-game-servers . After going through all the steps - my client is not able to connect with the ECS Fargate tasks because the latter are not starting (not getting into RUNNING state). They get as far as PROVISIONING but then sputter - giving the CannotPullContainerError error. On top of that, I am a noob and cannot figure out where to find the complete error log entry, because it gets cut out. Nor do the cloudwatch logs show me the error. So I'm at a loss of how to troubleshoot. Image attached in problem description video https://youtu.be/AKkPpEOQDGA

by looking at this AWS document: https://docs.aws.amazon.com/step-functions/latest/dg/sample-project-container-task-notification.html step functions can totally instantiate/manage fargate or ECS Task. Speaking about fargate * the example put fargate as first step. suppose fargate is the 2nd step, can we get the output message from first step (larger than 8K) into fargate task through either .sync or .waitForTaskToken model? Instead of passing input parameters through fargate containerOverride's command or commands? * If above is possible, does the code inside fargate suppose to do something like : GetActivityTaskResult getActivityTaskResult = client.getActivityTask(new GetActivityTaskRequest().withActivityArn(stringActivityArn)); String taskToken = getActivityTaskResult.getTaskToken(); String taskInput = getActivityTaskResult.getInput(); * In this step function instantiate fargate model (.sync or .waitForTaskToken), does fargate instances gets created each time when step functions "calls" it? That is, we actually would like to set desire_count and min count both to zero and forget about scaling alarms or metrics. If above is true, does it respect the max_count? I guess cost-wise, it is fine with us because how many concurrent fargate running does not matter anymore. Cost is based on usage. * is ECS or fargate able to return output values to the calling step function? that is, using sendSucess or some other api to send output back to step function for next step to use (become the input of next step)?

How can I view logs for the EKS `fargate-scheduler` ? I can see the 'default-scheduler' logs in CloudWatch (named 'kube-scheduler' in cloudwatch), but cannot find documentation regarding logging the eks `fargate-scheduler`. I have read the documentation regard [Fargate logging](https://docs.aws.amazon.com/eks/latest/userguide/fargate-logging.html) and this is not what I want. This doc describes logging for pods running in eks fargate, but I want logs from the `fargate-scheduler` itself. I have read this [EKS Fargate troubleshooting](https://aws.amazon.com/premiumsupport/knowledge-center/eks-resolve-pending-fargate-pods/) doc as well, and this is also not what I want. While I appreciate AWS putting out troubleshooting guides, the `fargate-scheduler` knows already knows why my pods cannot be scheduled, and I'd like to view those logs. Thanks in advance for you help!

Hello, I'm using EC2 windows instance for browser UI automation test, but i have to regularly upgrade the system to meet company security poilicy. i'm thinking maybe fargate can help me get ride of the maintenance, but i'm not sure if i can access to the underlying OS through aws console or RDP. can i login to the OS and do some operations? Many Thanks, Judy

Hi, Will I be charged for Fargate idle instance? We are going to run activity as Fargate task within a step functions. Scaling parameters min_count=1 desire_count=1 Max_count=17 Scaling up if average CPU usage more than 50% and scaling down if usage less than 50%. Questions are * The above setup has a min and desire count =1, will we be charged for the CPU/Memory/storage usage 24 hrs a day, 7 days a week? The activity program pulls message from a SQS queue and start processing and on most part of the day, it should be idle. * I understand, there is aws cli command to set desire_count=0 but the messages comes in randomly over the day (i.e., we can not turn desire_count >0 during a period of time and turn it off). Is there a better way to design the system to save cost? Thank you.

Hi There I am new to computer clouding and I have been asked if I could run a latency test on our system. Basically our hardware communicates via the internet to our application which is hosted on AWS Cloud using Fargate with AWS ECS to run containers (as detailed below). My question is, is it possible to run a latency test when our application is structured on the cloud and structured in such way? UI Hosting: AWS Fargate with AWS ECS to run containers, NLB, AWS Ireland region. Backend: AWS ECS with AWS EC2 to run containers, AWS ECS with AWS Fargate, AWS Ireland region.

Hi, I have a long running java program on fargate with 1024 unit cpu (1cpu) and 4G ram. serving as one of the step in step functions workflow. The java program has * An infinite loop pulling message from a SQS queue * download a 17G .tar.gz file using Transfermanager from S3 from another account (only 3+ minutes) * uncompress the .tar.gz file which will create a 50 G file and a small .md5 file with checksum value within. * verify the checksum of 50G file against the content from .md5 file. (about 7 minutes) * upload the untar-ed file to another S3 through multipart upload (upload multipart and then combine) which took around 12 mins. The problem is that, based on my log, I see the program just stopped without exception sometimes during un-tar, sometimes during upload. I am just guessing there could be a system level issue (OS) or JVM died. Can somebody please share your thought of * ways of debugging it? * Guess the problem(s) or any other suggestions? Thanks you.

I am using an infrastructure setup as described in the title. This setup is also somewhat shown in this picture: https://d2908q01vomqb2.cloudfront.net/1b6453892473a467d07372d45eb05abc2031647a/2021/02/04/5-CloudMap-example.png In the official AWS blog here: https://aws.amazon.com/blogs/compute/configuring-private-integrations-with-amazon-api-gateway-http-apis/ the following is stated about using such setup: > As AWS Cloud Map provides client-side service discovery, you can replace the load balancer with a service registry. Now, connections are routed directly to backend resources, instead of being proxied. This involves fewer components, making deployments safer and with less management, and reducing complexity. My question is simple: What load balancing algorithm does HTTP API GW use when distributing traffic to resources (the Fargate tasks) registered in a service registry? Is it round-robin just as it is with ALB? Only thing I was able to find is this: > For integrations with AWS Cloud Map, API Gateway uses DiscoverInstances to identify resources. You can use query parameters to target specific resources. The registered resources' attributes must include IP addresses and ports. API Gateway distributes requests across healthy resources that are returned from DiscoverInstances. https://docs.aws.amazon.com/apigateway/latest/developerguide/http-api-develop-integrations-private.html#http-api-develop-integrations-private-Cloud-Map

Hi, I'm trying to use an EFS volume in a Batch job running on AWS Fargate. The support for EFS volumes was added in Fargate version 1.4.0 (see [here](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/platform-linux-fargate.html)). In the linked article, it's also stated that using `LATEST` is equivalent to specifying version number `1.4.0`. However, when I try to specify the `LATEST` as a Fargate platform version in the Batch job definition where I also specify EFS volumes, I get this error: ``` Failed to register job definition Error: Error executing request, Exception : EFS is supported for Fargate platform version 1.4.0., RequestId: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx ``` Specifying an explicit version number `1.4.0` works without problems. If this is a bug, how to report the issue?

Our application is deployed on fargate and it uses EFS to store files. We are experiencing an issue where [the written files don't show up because of NFS negative caching](https://repost.aws/questions/QU0j0fRjfWTGG5BSHuGVfxCg/aws-efs-file-delete-and-recreate-not-detected-programmatically-for-25-to). The [solution](https://repost.aws/questions/QU0j0fRjfWTGG5BSHuGVfxCg/aws-efs-file-delete-and-recreate-not-detected-programmatically-for-25-to) seems to be using `noac` or `lookupcache=pos` mount options for EFS. But I don't see a way to specify mount options when configuring EFS as a volume on Fargate. Is there a solution for Fargate or a workaround?

Hello, I am setting up a Yellowfin [deployment](https://wiki.yellowfinbi.com/display/yfcurrent/Install+in+a+Container) using their stock app-only [image](https://hub.docker.com/r/yellowfinbi/yellowfin-app-only) on ECS Fargate. I was able to set up a test cluster for my team to experiment with. Yellowfin requires a license to use their software. To issue a license, Yellowfin needs to know the hostname of the underlying platform it runs on. Yellowfin can provide wildcard licenses that match on a standard prefix or suffix. Currently, we are using a development license that matches on the default hostname that our test environment's Fargate task is assigned. The default hostname seems to be of the form <32-character alphanumeric string>-<10-digit number> where the former is the running task's ID and the latter is an ID of some other related AWS resource (the task definition? the cluster?) that I could not identify. Although this 10-digit number stays constant if new tasks are run, it does not seem like a good strategy to base the real Yellowfin license off of it. I would like to override the hostname of a Fargate task when launching the container to include a common prefix (e.g., "myorg-yfbi-") to make it simple to request a wildcard license for actual use. If possible, I would like to avoid building my own image or migrating to use another AWS service. Is there a standard way to override the hostname for a Fargate service by solely updating the task definition? Would overriding the entrypoint be a viable option? Is there another way to set hostname in Fargate that I am not aware of? Thank you for any guidance you can provide. Happy to provide more information if it helps.

Hi, since AWS [announced](https://aws.amazon.com/about-aws/whats-new/2021/11/aws-fargate-amazon-ecs-aws-graviton2-processors/) Fargate support for ARM64 architecture I'm curious if there is any way for Batch jobs running on Fargate to use ARM64. For ECS tasks, we can specify this in `runtimePlatform` in the [task definition](https://docs.aws.amazon.com/AmazonECS/latest/userguide/ecs-arm64.html). I was looking into the [job definition parameters](https://docs.aws.amazon.com/batch/latest/userguide/job_definition_parameters.html) for the same but there doesn't seem to be an option to specify ARM64. I also tried the brute force way of building the Docker image for ARM64 and running the job but it failed with exec format error. I couldn't find any mention for this topic nor the plans for adding the support (container roadmap). Thanks

Hello. I need to calculate the PDF task on my Fargate cluster and after finishing calculating the task should be stopped or terminated to decrease payments. The consequence of my actions: 1. Little task always running on EC2 Cluster and check DB to the new data. 2. If new data appears, using Boto3, run the Fargate container (big task to calculate PDF). 3. After the job is done, the task should be stopped. Also if in the DB appears the second row of data during proceeding the first task, Fargate should create a second task for the second job. and then stop tasks... So, I have: * PDF task written on Python and deployed on ECR * Fargate cluster * Task definition (describe Memory, CPU's and container) What is my next step? How task know, that it should be closed? Any idea or solution?

Hi All, We are trying to migrate from EC2 to AWS ECS Fargate and this is a PCI complaint environment. We would like to get inputs on how we could be complaint for PCI with Fargate implementation. Particularly it would be helpful if I get some inputs on how everyone is dealing with the run-time security of Fargate containers. It would be nice to know as to how requirements like anti-virus, FIM which were in EC2 are covered with AWS Fargate. Regards, Karthik

Hi, according to : https://aws.amazon.com/about-aws/whats-new/2021/04/amazon-ecs-aws-fargate-configure-size-ephemeral-storage-tasks/ latest fargate version allows configuration up to 200GB. Is that 200GB shared by all tasks or each task get it's own 200GB of space? That is, when fargate scale up the number of tasks, are all tasks sharing a single 200GB space? Or, if configured max number of tasks as 4. then we could get 4x200GB = 800GB of tasks while scaling up to the max number?

``` public class Example { public static void main(String[] args) { // print statement at the start of the program System.out.println("Start..."); System.out.print("Number of available processors are: "); System.out.println( Runtime.getRuntime().availableProcessors()); } } ``` Ref: https://www.tutorialspoint.com/get-number-of-available-processors-in-java When I compile and run this code on AWS ECS Fargate getting "1" as the output even though I have specified more than 1 cpu in task def(4098 for 4 vCPU). **Tested Java versions:** - Corretto-17.0.0.35.1 - Corretto-8.275.01.1 But when I do the same on AWS EC2 inside docker by allocating CPU with --cpus for "docker run" I get the exact number what I pass to --cpus. Same results with AWS EC2 with Containerd as well. Also tested this in EKS 1.18 by setting CPU limit. It returns the number of CPUs specified in the CPU limit. So, wondering why "1" only in AWS ECS.

I have been trying to find an answer in documentation, github, here and the old forums, but I fail to find the answer to my question. In my CDK v1 (python) I create a RDS instance of SQL Server and set credentials with aws_rds.Cerednetials.from_generated_secret(), but when I later on want to provide environment/sercrets values to the docker container I want to run in fargate I have the following environment variable that I need to be set: DB_CONNECTION_STRING, which has the following syntax: Server=<somehost.aws.com>,144;Database=<databasename>; User Id=<databaseuser>;Password=<databasepassword> All the examples I have seen uses multiple variables like DB_USER/DB_PASS/DB_HOST and then you can easily set those with help of secret_value, but there is no example on generating a connection string. How do you solve this? I took a look at aws glue, but it didn't feel like the right optionand I'm not too keen on making a dockerfile to try to pull the official docker image and then create a kind of a wrapper to have environment/sercret variables and then a script that builds up the connection string and sets it before calling the start script for the application (this has other downsides). The reason why I'm not using the CDK v2 is that the current version seems to be broken when you create a new project in WSL (seems to think it's pure ms-windows and fails to create a number of files needed). Thanks in advance for any reply.

Hello all, Our environment contains: - AWS EventBridge event to run an AWS Fargate task once an hour; - AWS ECS event and lambda to monitor task status changes Lately, we sometimes see that the AWS Fargate task fails to start due to the stopReason: > Rate limit exceeded while preparing network interface to be attached to instance I have checked our quotas, and we are very far (<50 ENIs out of 5000 per region). 1. What is the cause for this error? 2. Is a retry (the lambda to RunTask the task) a good workaround? Thank you in advance, Boris.

It is annoying to see #Fargate tasks rebooting every six hours and there is no documentation. (I have seen this in the past). Web search finds one relevant personal blog post: https://stephengream.com/fargate-task-recycling and the reference to the AWS article (https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task-recycle.html) is broken.  \[See the screenshot here: https://i.imgur.com/tfGZ7IK.png because AWS doesn't render it for god knows why!] Neither Google Cache nor http://Archive.org has it! Any idea why Fargate tasks reboots every 6 hours? What is Task Recycle?

As part of a conversation about whether or not we need end to end TLS, I am trying to understand the **communication path between an ALB and the ECS Fargate tasks it targets**. I'm assuming the ALB and service tasks are hosted on completely distinct instances? Are these instances logically part of my VPC or not? Is the traffic confined to my VPC or does it go via AWS network's? I am arguing there is nothing to gain with TLS between ALB and services, as long as we trust AWS network, but I cannot find official document to support my argument, other than a SO thread from a AWS employee. Can anyone shed some light? Thanks

I have created an Image in ECR, also created Fargate cluster and when I am defining task using hypens (-) for pulling ECR image e.g. 0000-0000-00000..dkr.ecr.ap-south-1.amazonaws.com/liferay:latest, I am getting ResourceInitializationError: unable to pull secrets or registry auth: pull command failed: : signal: killed. 2nd scenario while I am defining Task for pulling ECR Image without hypen (-) 0000000000000..dkr.ecr.apsouth1.amazonaws.com/liferay:latest, I am getting below error CannotPullContainerError: inspect image has been retried 5 time(s): failed to resolve ref "000000000000.dkr.ecr.ap.south.1.amazonaws.com/liferay:latest": failed to do request: Head https://000000000000.dkr.ecr.ap.south.1.amazonaws.com/v2/liferay/manife... Is Fargate not accepting hypens in Image name ?? or how to resolve, since Account Number and Regions contains hypen(s)

I have been using ECS Fargate to launch containers that are designed to execute some tasks and terminate once done. In the task definition, I have given `awslogs` as the `logDriver` and `awslogs-create-group` set to `true` so that each time it creates a log group in CloudWatch. But I notice in CW that the retention policy of the log groups is set to 'Never Expire', and over time there are many log groups that simply exist even though the cluster behind it are terminated. How can I ensure that the log groups are deleted as soon as the Fargate cluster/task is terminated?

We have dockerized Rails application and It is deployed on AWS(using Fargate). Currently, we have Dev and Staging servers running on AWS. We use Resque for scheduling and queuing purpose. We do use foreman to start below processes once deployment is completed. **Dockerfile** **Docker CMD bundle exec foreman start -f Procfile.dev-server** **Procfile.dev-server ** **web: bundle exec rails s -p 3000 -b '0.0.0.0' queues: bin/rake environment resque:work QUEUE=responsive_tasks scheduler: bin/rake environment resque:scheduler** This setup is good and working fine till staging environment. Foreman is not recommended for Production setup and might be issue when scaling would require as all 3 processes running on same machine. Doubt How I can run all 3 different processes(web server, queues and schedulers) without Foreman once code is deployed on AWS for production? Shall I run Resque servers on separate instance with same Rails app code?

We have an IoT device that connects to our MQTT broker behind the NLB. We are keeping the connection between IoT device and broker by utilising MQTT Keep Alive time and brokers heartbeat intervals. Our IoT device sleeps most of the time. It wakes up in the following situations. Whenever it wants to send PINQREST(every 340s -MQTT Keep Alive time) sends it to the broker. Other microservices publish some data, and brokers send that information to IoT devices. Our objective is to sleep the IoT device as much as possible and maintain the connection to save the battery. ***Problem: ***Normally, this particular IoT device sleeps most of the time. Our objective is to keep it sleeping as much as possible while maintaining a connection between IoT Device and the MQTT broker. The problem is that IoT Device continuously wakes up every 20s whenever the broker sends some downstream data to the IoT device. This usually happens whenever IoT Device receives downstream data from a broker. Based on our vendor's packet analysis, we found that NLB sends 120 bytes of TCP Keep-alive packets to IoT devices every 20s right after the broker publishes some downstream data. This is entirely sent by NLB and not by the broker. ***Only happen in TLS : ***We found that this happens if we use TLS(8883) in NLB and terminate the TLS in NLB. If we remove the TLS, add the listener on a non-secure port (1883), and forward the traffic to Target's non-secure port, things are working as expected, and there are no 20s wake-up or keep-alive packet sent by NLB every 20s. We also tested the same setup with CLB in an SSL port. It works without any problem and does not send a keep-alive to the client (IoT device). We have removed the TLS and opened the non-secure port as a temporary workaround. Why does NLB send keep-alive packets every 20s if we use TLS ? is this an intended behaviour of NLB? Any idea how we could resolve it? ***The overview of the cloud setup: *** * MQTT broker runs in ECS Fargate * Multi-AZ * Broker in a private subnet NLB is in between * Client (IoT device) and Target(MQTT Broker) * NLB idle time keep resetting by two things * Keep alive time sent by Client(IoT device) every * 340s Heartbeat time published by Target (MQTT Broker)every 340s Connection remains open NLB offload the TLS in port 8883 and forward the traffic to target port 1883

Hey there! I've been attempting to use ECS Fargate with Windows containers and am running into some unclear documentation. It seems in the documentation, platform version 1.0.0 is the latest given to Windows, and 1.4.0 is the latest given to Linux containers. Now, there are certain task definition's that are supposedly available to Windows according to the documentation but turn out not to be. I'll list this here in the hopes that this could be cleared up by the ECS Fargate team. 1. ephemeralStorage - Here it's shown the ephemeralStorage is able to adjusted on Windows Fargate https://docs.aws.amazon.com/AmazonECS/latest/developerguide/fargate-task-storage.html and here https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ecs-taskdefinition-ephemeralstorage.html, however in the API doc it says this is not available for Windows https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task_definition_parameters.html I believe that 1.0.0 does not actually support this as I've been trying to run a large unreal engine docker image (151gb uncompressed) and keep getting "CannotPullContainer: failed to extract layer" errors. 2. environmentFiles - At these docs https://docs.aws.amazon.com/AmazonECS/latest/developerguide/taskdef-envfiles.html it is shown that the environmentFiles field should work for Windows 1.0.0 but whenever I try to include this field in my Windows task I get a PlatformTaskDefinitionIncompatibilityException which makes me suspect it is not actually implemented. You can follow this issue I made here https://github.com/aws/containers-roadmap/issues/1626 I suspect there are probably more discrepancies between the documentation and the implementation for Windows Fargate, and I suspect not many people are running Windows containers on Fargate, but I do feel this should be rectified! I'll continue adding to this list if anything more comes up. I'm going to attempt to instead run a cluster on an EC2 instance and hopefully the process will be a bit smoother.

Hello, I have a problem with delayed shutdown of ECS Fargate tasks, let me explain by example: * in a Docker image at the very last line of the entrypoint script I have simple echo statement. It's being logged at 11:18:22.004 * I have another process, which is checking ECS tasks statuses on some events, an it's logged that at 11:18:30.023 (8 s later execution of last line of entrypoint) both last and desired statuses of the task are RUNNING So my question is it expected that ECS Fargate takes more than 8 secs to shutdown task, specially considering that desired status also remains RUNNING after that time.

Hi All, I am running an ECS Cluster for our Kafka Connect Images and have a working configuration deployed. To scale up Kafka Connect one of the things you need to do for each container is ensure that the Kafka Connect Rest Hostname is set to prevent a 409 Conflict when adding tasks (if you are running as part of a cluster). Using localhost is fine for a single node - but not for multiple. Since I am running ECS in Fargate awsvpc mode. I didn't see a way to get the IP of the Container (per AWS docs not supported in awsvpc mode). To work around this problem I added a custom command for the container on startup to call the container metadata service and set it that way e.g. ``` JSON=$(curl ${ECS_CONTAINER_METADATA_URI}/task) TASK=$(echo $JSON | jq -r '.Containers[0].Networks[0].IPv4Addresses[0]') CONNECT_REST_ADVERTISED_HOST_NAME=$TASK ``` Is there a more native way to do this? Best, Wayne

I am trying to deploy two docker containers via docker compose to ECS. This already worked before. Now I'm getting the following error: > **DatabasemongoService TaskFailedToStart: Unexpected EC2 error while attempting to tag the network interface: InvalidParameterValue** I tried deleting all resources in my account and recreating a default VPC which the docker compose uses to deploy. I tried tagging the network interface via the management web UI, which worked without troubles. I found this Documentation about EC2 Error Codes: https://docs.aws.amazon.com/AWSEC2/latest/APIReference/errors-overview.html > **InvalidParameterValue**: A value specified in a parameter is not valid, is unsupported, or cannot be used. Ensure that you specify a resource by using its full ID. The returned message provides an explanation of the error value. I don't get any output besides the error above to put my search on a new trail. Also there is this entry talking about the error: > InvalidNetworkInterface.InUse: The specified interface is currently in use and cannot be deleted or attached to another instance. Ensure that you have detached the network interface first. If a network interface is in use, you may also receive the **InvalidParameterValue** error. As the compose CLI handles creation and deletion of network interfaces automatically, I assume this is not the problem. Below is my docker-compose.yaml file. I start it via `docker compose --env-file=./config/.env.development up` in the ecs context. ``` version: '3' services: feathers: image: xxx build: context: ./app args: - BUILD_MODE=${MODE_ENV:-development} working_dir: /app container_name: 'feather-container' ports: - ${BE_PORT}:${BE_PORT} environment: - MODE=${MODE_ENV:-development} depends_on: - database-mongo networks: - backend env_file: - ./config/.env.${MODE_ENV} database-mongo: image: yyy build: context: ./database container_name: 'mongo-container' command: mongod --port ${MONGO_PORT} --bind_ip_all environment: - MONGO_INITDB_DATABASE=${MONGO_DATABASE} - MONGO_INITDB_ROOT_USERNAME=${MONGO_USERNAME} - MONGO_INITDB_ROOT_PASSWORD=${MONGO_PASSWORD} ports: - ${MONGO_PORT}:${MONGO_PORT} volumes: - mongo-data:/data networks: - backend networks: backend: name: be-network volumes: mongo-data: ``` Any help, idea, or point in the right direction is very appreciated!

Using ECR I created an ECS task and I created an IMGPROXY server and I bind to port 80. In security, I allowed all traffic anywhere for inbound and outbound. But when i am deploying the task it's showing this error that port is missing but i already opened all ports.

HI All I have 2 questions on how to use CDK to deploy ECS using python. 1. How do we set subnet on the cluster via CDK? The VPC is straightforward using the vpc parameter, however i could not find the param for subnet. 2. How do we set the architecture(x64 or ARM), using the CDK ? While creating the task I need to set the architecture to a specific value as I am getting the following error: standard_init_linux.go:228: exec user process caused: exec format error Thank you for your help. Regards

Hello All I am trying to accomplish the following > If you are using the Fargate launch type for your tasks, all you need to do to turn on the awslogs log driver is add the required logConfiguration parameters to your task definition. I am using CDK to generate the FargateTaskDefn ``` task_definition = _ecs.FargateTaskDefinition(self, "TaskDefinition", cpu=2048, memory_limit_mib=4096, execution_role=ecs_role, task_role = ecs_role, ) task_definition.add_container("getFileTask", memory_limit_mib = 4096, cpu=2048, image = _ecs.ContainerImage.from_asset(directory="assets", file="Dockerfile-ecs-file-download")) ``` I looked up the documentation and did not find the any attribute called logConfiguration. What am I missing? I am not able to send the logs from Container running on ECS/Fargate to Cloudwatch and what is needed is to enable this logConfiguration option in the task defn. Thank you for your help. Regards

I have an existing API Gateway REST Api with a Resource I want to use as a public ingress for an Application Load Balanced Fargate App that lives inside a VPC. I know in order to make this work I need to create a VPC Link and use that as an integration in my API Resource. My question is twofold: 1) What kind of VPC Endpoint should I create such that my Public APIGW REST API can talk to my Application Load Balanced Fargate App behind a VPC via VPC Link? (e.g. ecs, ec2..etc?) 2) What is the structure of the endpoint url that I will use in my APIGW Resource VPC Link integration? Or better yet, where can I find documentation on how to construct this url? Thanks in advance!

I'm running Fargate in AWS Batch. If I want to give the task S3 access, which of the following Roles should I add the policy to? - AWS Batch execution IAM role - job role I know that Fargate uses task roles. However, there was no setting item called task role in AWS Batch. Best regards,

Hi, I try to execute an ECS task every night for copying some data. My configuration is very simple: []( https://i.ibb.co/p1M1mK1/Screenshot-2021-12-20-at-14-49-38.png) If I look at the metrics in CloudWatch, the task is successfully invoked: [](https://i.ibb.co/VwkbJj0/Screenshot-2021-12-20-at-15-10-06.png) But when I look at the logs in CloudWatch, I only see my tests¹ (2021-12-16 at around 3PM UTC+1) and the first nightly invocation of 2021-12-17 4AM UTC+1. I don’t see the next ones (2021-12-18, 2021-12-19 and 2021-12-20). I can confirm that no data were copied these days. [](https://i.ibb.co/GVZQR5D/Screenshot-2021-12-20-at-15-18-34.png) Why my task is not executed every night? What I am missing? 1: for the tests, the task was scheduled to run minutely (`cron(0 3 * * ? *)`)

Hi AWS Support Engineer I am getting billed for Amazon Elastic Container Service resources, which are not running ( or at least I am unable to find out) in my account. I have raised the AWS ticket and they have directed me to this forum. Please note earlier in November end, whatever fargate services/tasks I could find I had deleted and post that there were no charges levied. It was also confirmed by support person that there wont be any new charges as services are deleted. But in last 2 to 3 days it has started appearing again. Kindly assist to resolve this as soon as possible. Regards Ashwin

Hello. I have a PDF service (Task definition + Service + Task), which runs in the EC2 cluster. This service runs less than 100 times per month and duration is approx 3-5 minutes, but it is a high-performance task, and I enforced each time increase the power of the instance. Also, this instance operates 13 additional tasks with low performance. I start this task on Linux t3.large Instance. So I would like to separate this PDF Task from the EC2 instance to save monthly charging by paying just for operating PDF tasks. I've read about Fargate, but as I understood if I create a container, task definition I will pay all the same for running the Fargate cluster, but not for time running task! Question: How to run Task and pay only for it operating?

We are having lots of AWS Accounts. Is there a way to manage ECS clusters across these accounts without logging back and forth between the accounts? Especially, if there are any tools for ECS like Lens for K8S, that will be really great.

Hello, I have two questions regarding the tableau Server and Installation Can we install Tableau on AWS Elastic Beanstalk Environment running Ec2 instance? Also is there a way to install Tableau Server on Serverless Environments such as AWS Lamda or AWS Fargate?

I have been using a command line invocation like this ``` ecs-cli logs --task-id {task-id} --cluster foo --aws-profile foo ``` to retrieve logs from tasks that have been previously been started by `aws ecs run-task` and waited for with `aws ecs wait tasks-stopped`. The relevant code has been running for 2.5 years or so without significant issue and, in fact, is still running in one of our AWS accounts, but in another one, the `ecs-cli logs` command just hangs forever for no apparent reason. It used to run just fine in this account too, as recently as 2 weeks ago. I can't find any reason why the this would be happening. The credentials are good. The tasks executes correctly in the failing environment and has stopped, but the `ecs-cli logs` command hangs. I am not specifying a --follow option on the logs command. The hand isis happening when ecs-cli is run run both on our build machine and our development laptops. These commands can run `eccs-cli logs` on tasks in a different account/vpc/cluster without error. I am running ecs-cli v1.21.0 everywhere. Any suggestions about how I can debug this further? **update**: since first posting, I have learnt some more about the situation - the problem briefly (for a couple of days) stopped occurring. At the time, I thought the problem was occurring because of some misaligned configuration in an apparently unrelated component (cloudwatch-related configuration of API Gateway) and when I fixed that misalignment the problem stopped happening - however, the problem has since returned for reasons unknown and the configuration difference does not explain it as all the configuration is aligned with what it should be and how it is configured in other environments - the user concerned has the standard Administrator role, so it isn't a permissions problem. a similar user is configured in the same way in other environments and - it IS NOT a connectivity problem to the AWS services since I can execute the same scenarios in different accounts in the same region indicating that connectivity to the AWS endpoints is working (also see next point below - the request is getting to the API) - I get an error response from ecs-cli logs if I deliberately specify an incorrect task-id. If I specify a correct task-id, the command hangs for at least 10 minutes without generating any output

I have ECS with Fargate. Traffic is routed with NLB. When service is just started NLB routes traffic equally to all tasks with no problem. However, when service is automatically sales up (or if I manually increase tasks count) NLB is not routing traffic to a newly created tasks. Despite the fact that new task are marked as *healthy* in a Target group. I can see it clearly form new tasks log and from "about zero" minimum CPU on the Service.