Does anyone know what would be causing my ecsTask flows to fail with the error

Submission failed. botocore.errorfactory.ClientException: An error occurred (ClientException) when calling the RegisterTaskDefinition operation: Fargate requires task definition to have execution role ARN to support ECR images

My ecsTask block looks like:

ecs-task/trigger-flow
┌─────────────────────────────────┬─────────────────────────────────────────────────────────────────────┐
│ Block Type                      │ ECS Task                                                                                                                                                                                                                         │
│ Block id                        │ a084e009-76b4-47d6-a249-b92bd98dc45b                                                                                                                                                                                             
├─────────────────────────────────┼─────────────────────────────────────────────────────────────────────┤
│ cpu                             │ 512                                                                                                                                                                                                                              
│ vpc_id                          │ vpc-xxxxxxxxx                                                                                                                                                                                                            
│ cluster                         │ arn:aws:ecs:us-east-1:xxxxxxxxx:cluster/prefect                                                                                                                                                                               
│ stream_output                   │ True                                                                                                                                                                                                                             
│ task_role_arn                   │ arn:aws:iam::xxxxxxxxx:role/ecsTaskExecutionRolePrefect                                                                                                                                                                       
│ task_definition                 │                                                                                                                                                                                                                                  
│ execution_role_arn              │ arn:aws:iam::xxxxxxxxx:role/ecsTaskExecutionRolePrefect                                                                                                                                                                       
│ task_customizations             │ []                                                                                                                                                                                                                               
│ task_definition_arn             │ arn:aws:ecs:us-east-1:xxxxxxxxx:task-definition/flow-run-a-test:4                                                                                                                                                             
│ cloudwatch_logs_options         │ {}                                                                                                                                                                                                                               
│ configure_cloudwatch_logs       │ True                                                                                                                                                                                                                             
│ auto_deregister_task_definition │ False                    
└─────────────────────────────────┴─────────────────────────────────────────────────────────────────────┘

And the execution_role and task_role both have the managed AmazonECSTaskExecutionRolePolicy which includes

"Action": [
                "ecr:GetAuthorizationToken",
                "ecr:BatchCheckLayerAvailability",
                "ecr:GetDownloadUrlForLayer",
                "ecr:BatchGetImage",
                "logs:CreateLogStream",
                "logs:PutLogEvents"
            ],

Am I going crazy, or are those not sufficient permissions? Stackoverflow says that they are, but I could be misinterpreting things. It seems like the ECS Task that should run the Prefect task isnt inheriting the execution role from the Task Definition.

Hey @Cody. Did you ever get this working? I'm facing the same issue

Yes. I think it was that I had to give the workpool itself an execution role. I just added it in the webui.

Thanks @Cody 🙂 Just for anyone else that hits this issue these are the steps that worked for me. Create the role. Specify that role as the

Execution Role ARN

in the Prefect UI for the ECS work pool.