https://prefect.io logo
c

Cody

07/03/2023, 11:05 PM
Does anyone know what would be causing my ecsTask flows to fail with the error
Submission failed. botocore.errorfactory.ClientException: An error occurred (ClientException) when calling the RegisterTaskDefinition operation: Fargate requires task definition to have execution role ARN to support ECR images
My ecsTask block looks like:
Copy code
ecs-task/trigger-flow
┌─────────────────────────────────┬─────────────────────────────────────────────────────────────────────┐
│ Block Type                      │ ECS Task                                                                                                                                                                                                                         │
│ Block id                        │ a084e009-76b4-47d6-a249-b92bd98dc45b                                                                                                                                                                                             
├─────────────────────────────────┼─────────────────────────────────────────────────────────────────────┤
│ cpu                             │ 512                                                                                                                                                                                                                              
│ vpc_id                          │ vpc-xxxxxxxxx                                                                                                                                                                                                            
│ cluster                         │ arn:aws:ecs:us-east-1:xxxxxxxxx:cluster/prefect                                                                                                                                                                               
│ stream_output                   │ True                                                                                                                                                                                                                             
│ task_role_arn                   │ arn:aws:iam::xxxxxxxxx:role/ecsTaskExecutionRolePrefect                                                                                                                                                                       
│ task_definition                 │                                                                                                                                                                                                                                  
│ execution_role_arn              │ arn:aws:iam::xxxxxxxxx:role/ecsTaskExecutionRolePrefect                                                                                                                                                                       
│ task_customizations             │ []                                                                                                                                                                                                                               
│ task_definition_arn             │ arn:aws:ecs:us-east-1:xxxxxxxxx:task-definition/flow-run-a-test:4                                                                                                                                                             
│ cloudwatch_logs_options         │ {}                                                                                                                                                                                                                               
│ configure_cloudwatch_logs       │ True                                                                                                                                                                                                                             
│ auto_deregister_task_definition │ False                    
└─────────────────────────────────┴─────────────────────────────────────────────────────────────────────┘
And the execution_role and task_role both have the managed AmazonECSTaskExecutionRolePolicy which includes
Copy code
"Action": [
                "ecr:GetAuthorizationToken",
                "ecr:BatchCheckLayerAvailability",
                "ecr:GetDownloadUrlForLayer",
                "ecr:BatchGetImage",
                "logs:CreateLogStream",
                "logs:PutLogEvents"
            ],
Am I going crazy, or are those not sufficient permissions? Stackoverflow says that they are, but I could be misinterpreting things. It seems like the ECS Task that should run the Prefect task isnt inheriting the execution role from the Task Definition.
b

Brendan Maguire

08/14/2023, 4:05 PM
Hey @Cody. Did you ever get this working? I'm facing the same issue
c

Cody

08/14/2023, 4:08 PM
Yes. I think it was that I had to give the workpool itself an execution role. I just added it in the webui.
b

Brendan Maguire

08/14/2023, 4:25 PM
Thanks @Cody 🙂 Just for anyone else that hits this issue these are the steps that worked for me. Create the role. Specify that role as the
Execution Role ARN
in the Prefect UI for the ECS work pool.