https://prefect.io
Join Slack
Hello All. I get this error in Prefect UI. I am trying to run a job in Fargate and use a custom imag...
# ask-community
p
Hello All. I get this error in Prefect UI. I am trying to run a job in Fargate and use a custom image in ECR An error occurred (ClientException) when calling the RegisterTaskDefinition operation: Fargate requires task definition to have execution role ARN to support ECR images.
a
Can you show your ECSRun definition? How do you start your ECS agent - as an ECS service in-cluster or in some other way?
p
''' RUN_CONFIG = ECSRun(     labels=["prod"],     task_role_arn="arnawsiam:<accountnum>role/prefectTaskRole",     run_task_kwargs=dict(cluster="prefect-cluster", launchType="FARGATE",),     image="xxxxx.dkr.ecr.us-east-1.amazonaws.com/prefect-custom-image" ) '''
I start my ECS agent as an ECS service in cluster
a
nice! based on the error message you shared, it looks like the execution role doesn’t have access to ECR - can you share your IAM policy you used as the execution role?
p
Copy code
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ec2:AuthorizeSecurityGroupIngress",
        "ec2:CreateSecurityGroup",
        "ec2:CreateTags",
        "ec2:DescribeNetworkInterfaces",
        "ec2:DescribeSecurityGroups",
        "ec2:DescribeSubnets",
        "ec2:DescribeVpcs",
        "ec2:DeleteSecurityGroup",
        "ecr:GetAuthorizationToken",
        "ecr:BatchCheckLayerAvailability",
        "ecr:GetDownloadUrlForLayer",
        "ecr:BatchGetImage",
        "ecs:CreateCluster",
        "ecs:DeleteCluster",
        "ecs:DeregisterTaskDefinition",
        "ecs:DescribeClusters",
        "ecs:DescribeTaskDefinition",
        "ecs:DescribeTasks",
        "ecs:ListAccountSettings",
        "ecs:ListClusters",
        "ecs:ListTaskDefinitions",
        "ecs:RegisterTaskDefinition",
        "ecs:RunTask",
        "ecs:StopTask",
        "iam:PassRole",
        "logs:CreateLogStream",
        "logs:PutLogEvents",
        "logs:DescribeLogGroups",
        "logs:GetLogEvents"
      ],
      "Resource": "*"
    }
  ]
}
prefectTaskRolePolicy
a
I think this is the Task Role. In your Task execution role, I think the ECR access is missing. I will try to build an example policy you can use
p
hmm, I missed it then
thanks for the help in advance
a
if you have this in your Task Execution Role, then this should work
p
No, I don't have it
{   "Version": "2012-10-17",   "Statement": [     {       "Effect": "Allow",       "Action": [         "ssm:GetParameters"       ],       "Resource": "*"     }   ] }
I will add it
a
if you followed this demo, then you should have it already.
p
yeah, I used it. BTW, thanks for the outstanding article
a
thank you so much! Really curious about this error. Keep me posted once you know more, or share your traceback if you get another error
p
Sure, I am still getting error but let me know to double check it first
a
btw, you can also pass this explicitly to your ECSRun:
Copy code
execution_role_arn="arn:aws:iam::XXXXXX:role/prefectECSAgentTaskExecutionRole",
p
Hello. Adding the execusion role arn to ECRUN solved my issue
👍 1
Thank you
13 Views
Open in Slack
PreviousNext
Powered by

Prefect Community

Bring your towel and join one of the fastest growing data communities. Welcome to our second-generation open source orchestration platform, a completely rethought approach to dataflow automation.

Powered by