Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Handling permission error when describing task definition #140

Open
sota1235 opened this issue Aug 10, 2020 · 2 comments
Open

Handling permission error when describing task definition #140

sota1235 opened this issue Aug 10, 2020 · 2 comments

Comments

@sota1235
Copy link

sota1235 commented Aug 10, 2020

Hello
I'm one of the developer using this awesome software.

When I tried to use this software in my software, I faced the problem below.

  • Try to deploy ECS task definition with --task option
  • Then, I got error message 'Unknown task definition arn: {my task definition name}'
  • But it's appear on AWS console

As a result of my investigation, the cause is

So, my proposal is here.

  • 1st idea: When catching ClientError, parse that error and if it's permission error, change error message
  • 2nd idea: Not catching error
    • it seems that some of codes doesn't catch error from boto3 and to be honest, it's really useful for me when my IAM role's permission was wrong

If you need, I can send a PR. But before that, I want to hear feedback for my proposal.
Best,

@fabfuel
Copy link
Owner

fabfuel commented Aug 13, 2020

Hi @sota1235 & thanks for your issue description!

If I remember correctly, the error identification in boto3 is not too transparent, and some specific cases would need to be parsed from the error message (text) or are even not specifically identifiable. But there is a good chance, that this changed by now.

I agree, that the described scenario can be misleading, as the error message suggests, that the TD does not exist - independent from permissions.

I have two follow up questions:

  1. would you please briefly describe your permissions setup? What kind of restrictions did you apply to the task definitions and/or user?
  2. Do you have the original error object/details of this operation which comes from boto3? What does the ClientError exactly look like?

Thanks!
Fabian

@brunocascio
Copy link

brunocascio commented Feb 21, 2021

I was facing the same issue. I solved adding ecs:RunTask permissions to the IAM User

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

3 participants