Hi folks today I m facing a strange issue I m using `AWSSecr

Question

Hi folks today I m facing a strange issue I m using `AWSSecretsManager` in a flow which runs on Prefect Fargate Agent The flow works fine if the flow runs with `launch type= FARGATE ` If the flow runs with `launch type= EC2 ` then I get the following error ```botocore exceptions NoRegionError You must specify a region ``` It seems that the flow cannot pick the region from the provided task execution role Any suggestions

Raphaël Riel · Answer

I have no definitive answer to this but from what I understand the SecretID is the same across both LaunchType Since one of the two doesn t work I assume the SecretID is not using the ARN type Which would contains the Region code This would led me to think that somehow the Region in FarGate is given as an ENV Var and that it is not the case in EC2 ENV var that Boto3 would recover at runtime Hope this help you figuring out your problem

Raphaël Riel · Answer

What is the format your are using for the SecretID

ale · Answer

Hi < Raphaël Riel> The secret ID is passed in using the ARN type

ale · Answer

An interesting thing I ve found is that setting the env var `AWS DEFAULT REGION` makes AWSSecretManager tasks to run indefinitely it remains in the Submitted status forever

Raphaël Riel · Answer

Oh so the problem lies in booting an Agent on AWS and not retrieving the secret

Raphaël Riel · Answer

Are you able to confirm in ECS Console that the Task is being started and that there is capacity in your Cluster

ale · Answer

Yep I can confirm

Raphaël Riel · Answer

Are the EC2 s underlying VPC Networks allowing outbound connections to the internet If your EC2 based container can t communicate back to the PRefect s server or cloud it wont be able to pick up flows

Raphaël Riel · Answer

Or report as an agent being ready

ale · Answer

Other flows are running fine so it seems not to be a problem related to networking

Raphaël Riel · Answer

Ok Unfortunately I m out of ideas stuck out tongue I wish you good luck with that

Spencer · Answer

It s the Fargate Agent I don t think it s intended to run on EC2 at all

ale · Answer

< josh> said that the Fargate Agent should be able to run flows on both Fargate and EC2

ale · Answer

Maybe < josh> can help slightly smiling face

ale · Answer

Seems to be a network issue The container in the EC2 network does not have internet access We tried to use networkMode `bridge` but then we realised that Fargate Agent set it to `awsvpc` when creating new tasks

ale · Answer

I m going to open a PR to support bridge networkMode Do you guys see any issues with this mode compared with awsvpc

Spencer · Answer

Is this the task to start the flow or the flow run itself ツ