AWS Cloudwatch + ECS - What permissions to set?

5
votes

I'm trying to set up an ECS Fargate job to run based on a Cloudwatch trigger, specifically a Cloudwatch scheduled (cron) trigger. I have an ECS cluster set up, and when I manually create an ECS Fargate task on my cluster then the job runs fine without error. I also have a Cloudwatch cron trigger set up, and I can see in the Cloudwatch metrics that the trigger is being set off the way I configured it. The problem I'm having is that these two things are not talking to each other. I'm getting FailedInvocations in my Cloudwatch metrics dashboard, but as far as I can tell I can't find any logs as to what is failing.

Can someone provide me some details as to what I might need to set this up? I'm doing this using Terraform, so a Terraform-based solution would be most helpful.

I've tried fiddling around with IAM roles and permissions but I'm not quite sure what IAM roles and policies I need, or even if IAM is my problem. I also noticed that the Cloudwatch trigger has a role, and also the Cloudwatch task execution has a role; I've tried various things for both of these but not sure what role (in the task ecosystem) each of these IAM roles plays so I don't know what permissions are required for each one.

Thanks!

1
amazon-web-servicesscheduled-tasksamazon-iamamazon-ecsamazon-cloudwatch
I am not familiar with Terraform and I deploy using CloudFormation. Do you see that the CloudWatch event has the right Target? You can see that in the CloudWatch console. - Sriharsha Polimetla
Yes, everything is set up correctly, as far as I can tell (although I don't know much about how AWS services talk to each other, although the alarm is set up and the target is set up correctly) - Ertai87
If the error is due to permissions, try opening up the CloudTrail dashboard, which will show you exactly what requested which permissions when. - Chuck Adams
can you copy and paste your IAM polices for your ecs and cloudwatch? - Hamuel

1 Answers

0
votes

If you're using Cloudwatch, open the CloudTrail dashboard. This will allow you to see what is requesting permissions, and allow you to change given permissions. This dashboard will also allow you to see GeoLocation and other such data, but that is besides the point for this question. Also, some credit to Chuck Adams in the comments for also pointing this out.