Hey y'all! I had a question regarding IAM permissi...
# ask-community
r
Hey y'all! I had a question regarding IAM permissions on the AWS task that the prefect agent creates to run a flow. What's the best way to add a task-role and a sec group on it? I tried using https://docs.prefect.io/orchestration/flow_config/run_configs.html#ecsrun but to no avail. I see the values on prefect cloud's UI under advanced settings, but I don't see anything on the actual Task Def that gets created. Is this the correct way to accomplish something like this? Or am I on the wrong track here?
k
Hi @Rajdeep Rao! You tried supplying a YAML file with the
task_definition_path
?
r
Hey! 👋 I have not. Is this the
task_definition_path
param in the run_config() that you're talking about?
I did read that if I wanted to get funky, I'd have to ensure that I had a flow-container or something?
That turned me away from trying that
Copy code
from prefect import task, Flow
from prefect.storage import Docker
from prefect.run_configs import ECSRun


@task(log_stdout=True)
def task_name():
    do task_logic
    print(value)
    return(value)

with Flow("Test-Rostering-Flow-3", storage=Docker(registry_url="url",
                                                  image_name="test",
                                                  base_image="image"
                                                  )) as flow:
    value = task_name()

networkConfiguration = {
    'awsvpcConfiguration': {
        'securityGroups': [
            'sg-xxxxxx',
        ]
    }
}
flow.run_config = ECSRun(
    task_role_arn="arn:aws:iam::xxxx:role/somethingTaskRole",
    run_task_kwargs=networkConfiguration,
    env={"SOME_VAR": "value"})
print(flow.run_config)
flow.run()
flow.register(project_name="STAGING/test-setup", labels=['staging'])
Here's how my code looks fwiw ^
k
I see. I may have yo get back tomorrow but I’ll be taking a look at this tonight.
r
Thank you so much! 😄
k
If you need something more immediately though, this blog may help you.
r
I just realized I had
prefect agent start fargate
and I believe that's deprecated. I'm going to run an ECS agent and see if that does the trick
That did it! Once I ran the ecs agent, the ECSRunConfig() started getting respected!
Wohooo 🎉 Thanks for your help Kevin!
k
Oh I see. Glad you figured it out!