AWS Ресурс сервиса стека стека CloudFormation зависает на CREATE_IN_PROGRESS.

Question

У меня нижеприведенный сценарий облачной информации, который отлично работает с моей командой create-stack, кроме ресурса службы, который висит на CREATE_IN_PROGRESS. Надеюсь, вы все можете увидеть какую-то вопиющую проблему, по которой я скучаю.

Я не вижу возможности глубже вникнуть в детали того, где он находится, кроме страницы «События», которая просто показывает эту зависшую строку состояния, но с удовольствием предоставлю больше информации, если я в состоянии.

AWSTemplateFormatVersion: '2010-09-09'
Description: container on ecs cluster

Resources:

  # Defines container. This is a simple metadata description of what
  # container to run, and what resource requirements it has.
  Task:
    Type: AWS::ECS::TaskDefinition
    Properties:
      Family: apis
      Cpu: 256
      Memory: 512
      NetworkMode: awsvpc
      RequiresCompatibilities:
        - FARGATE
      ExecutionRoleArn: 'iamRoleHere'
      ContainerDefinitions:
        - Name: booksapi
          # this is the image name from our repo that we made early on: aws ecr describe-repositories 
          Image: 'imageHere'
          Cpu: 256
          Memory: 512
          PortMappings:
            - ContainerPort: 50577
              Protocol: tcp

  # The service. The service is a resource which allows you to run multiple
  # copies of a type of task, and gather up their logs and metrics, as well
  # as monitor the number of running tasks and replace any that have crashed.
  # defines how the task or container will be scheduled and deployed in the cluster and how the container instances will be registered with load balancer
  Service:
    Type: AWS::ECS::Service
    DependsOn: ListenerRule
    Properties:
      #if using param for servicename: !Ref 'ServiceName'
      ServiceName: booksapi
      TaskDefinition: !Ref 'Task'
      Cluster: !ImportValue 'ECSCluster'
      LaunchType: FARGATE
      DesiredCount: 2
      DeploymentConfiguration:
        MaximumPercent: 200
        MinimumHealthyPercent: 70
      NetworkConfiguration:
        AwsvpcConfiguration:
          AssignPublicIp: ENABLED
          Subnets:
            - 'subnet-abctyui'
            - 'subnet-poyfdha'
          SecurityGroups:
            - !ImportValue ContainerSecurityGroup
      LoadBalancers:
        - ContainerName: booksapi
          ContainerPort: 50577
          TargetGroupArn: !Ref TargetGroup

  # A target group. This is used for keeping track of all the tasks, and
  # what IP addresses / port numbers they have. You can query it yourself,
  # to use the addresses yourself, but most often this target group is just
  # connected to an application load balancer, or network load balancer, so
  # it can automatically distribute traffic across all the targets.
  # add 443 after POC. remove health check for now as it is buggy at the moment in our template
  TargetGroup:
    Type: AWS::ElasticLoadBalancingV2::TargetGroup
    Properties:
      Name: books-tg
      VpcId: 'vpc-ljhdfrr'
      Port: 80
      Protocol: HTTP
      Matcher:
        HttpCode: 200-299
      HealthCheckIntervalSeconds: 10
      HealthCheckPath: /stat
      HealthCheckProtocol: HTTP
      HealthCheckTimeoutSeconds: 5
      HealthyThresholdCount: 10
      TargetType: ip

  ListenerRule:
    Type: AWS::ElasticLoadBalancingV2::ListenerRule
    Properties:
      ListenerArn: !ImportValue Listener
      Priority: 2
      Conditions:
        - Field: path-pattern
          Values:
            - /v1/books*
      Actions:
        - TargetGroupArn: !Ref TargetGroup
          Type: forward


Outputs:

  ApiEndpoint:
    Description: Tests API Endpoint
    Value: !Join ['', ['http://', !ImportValue DomainName, '/v1/books']]
    Export:
      Name: 'BooksApiEndpoint'

Answer 1

Ах, я смог go к сервису в ecs и посмотреть там на вкладку событий: service booksapi failed to launch a task with (error ECS was unable to assume the role 'iamRoleHere' that was provided for this task. Please verify that the role being passed has the proper trust relationship and permissions and that your IAM user has permissions to pass this role.).