Running AWS Log Agent from inside a Fargate container

Question

Trying to run the AWS Logs Agent inside a docker container running on AWS ECS Fargate.

This has been working fine under EC2 for several years. Under Fargate context, it does not seem to be able to resolve the task role being passed to it.

Permissions on the Task Role should be good... I've even tried giving it full CloudWatch permissions to eliminate that as a reason.

I've managed to hack the python based launcher script to add a --debug flag which gave me this in the log:

Caught retryable HTTP exception while making metadata service request to
 http://169.254.169.254/latest/meta-data/iam/security-credentials

It does not appear to be properly resolving the credentials that are passed into the task as the 'Task Role'

Answer 1

I managed to find a hack workaround, that may illustrate what I believe to be a bug or inadequacy in the agent. I had to hack the launcher script using sed as follows:

sed -i "s|HTTPS_PROXY|AWS_CONTAINER_CREDENTIALS_RELATIVE_URI=$AWS_CONTAINER_CREDENTIALS_RELATIVE_URI HTTPS_PROXY|" 
/var/awslogs/bin/awslogs-agent-launcher.sh

This essentially de-references the ENV variable holding the URI for retrieving the task role and passes it to the agent's launcher.

It results in something like this:

/usr/bin/env -i AWS_CONTAINER_CREDENTIALS_RELATIVE_URI=/v2/credentials/f4ca7e30-b73f-4919-ae14-567b1262b27b (etc...)

With this in place, I restart the log agent and it works as expected.

Note that you can do something like this to add --debug flag to the launcher also which was very helpful in trying to figure out where it went astray.