Assume Role error given when actual issue is AWS Load Balancer Target Group ARN defined incorrectly

[ryan-kimber]

We are getting the following error in our deploy job when I run a reset (and a regular run fails with a different error):

Our deploy is running using our 'smartforms-deploy-creds-formhero' AWS Keys integration, using this IAM user: arn:aws:iam::595008428611:user/shippable-deploy. That user has admin privileges and explicitly has STS Assume Role permissions for all roles.

The loadbalancer configs look like the following:

• name: formhero-sandbox-filler-lb
  type: loadBalancer
  integration: smartforms-deploy-creds-formhero
  versionTemplate:
  sourceName: arn:aws:elasticloadbalancing:ca-central-1:595008428611:loadbalancer/app/formhero-sandbox-filler-lb/d93b2a68e4a76f1a
  method: application

[trriplejay]

It looks like we are assuming a role called "AWSServiceRoleForECS". Can you ensure that this role has the AmazonEC2ContainerServiceRole managed policy attached as documented here: https://docs.aws.amazon.com/AmazonECS/latest/developerguide/check-service-role.html

Also, you might want to consider explicitly specifying which role you want your loadBalancer to use. If not specified, Shippable will search for an appropriate role, but this means it could potentially change from deployment to deployment. You can set this in the loadBalancer resource by specifying a "role" in addition to a the method and sourceName: http://docs.shippable.com/platform/workflow/resource/loadbalancer/

let me know if that helps. since the error is "unable to assume role and validate the targetGroupArn" I suspect it's the "validate" part that is failing.

[ryan-kimber]

Ugh. This isn't an issue with permissions or assumeRole at all.

We provided the ARN for the loadBalancer in the YAML, instead of the ARN for the target group.

It would be a big help if Shippable provided a better error in this situation.

Perhaps you could check the ARN and ensure that 'targetgroup' is part of the string and not 'loadbalancer', as this is pretty easy mistake for someone to make (especially considering the shippable resource type is loadBalancer).

[trriplejay]

ah, i see. I'm glad you got it working. I'll open a task to try and improve the way we handle that error.

[a-murphy]

We're now checking for loadbalancer or targetgroup, depending on load balancer type, in the sourceName and logging a message is it's not present before trying to use sourceName.