Tailscale SSH session recording not starting in ECS: `unable to validate API key`

[jorgia111]

What is the issue?

Hi , I am trying deploy the Image: tailscale/tsrecorder:stable to aws ecs cluster however am getting the below error it doesn't like the API key and on what port the container run ? any help would be appreciated
error
tsrecorder: tsnet.Up: backend: invalid key: unable to validate API key

Steps to reproduce

No response

Are there any recent changes that introduced the issue?

No response

OS

No response

OS version

No response

Tailscale version

No response

Other software

No response

Bug report

No response

[maisem]

Did you follow the instructions on

https://tailscale.com/kb/1246/tailscale-ssh-session-recording/#deploy-a-recorder-node

[jorgia111]

I did follow that and that works on single ec2 instance however I am trying to deploy it on ecs cluster using cloud formation
but container is failed to start

[jorgia111]

@maisem anyhelp ? the container cant not start saying unable to validate API key

[maisem]

What does your cloud formation config look like? Are you sure you are providing it the TS_AUTHKEY env var?

on what port the container run

The service only ever listens on your tailnet so you won't be able to access anything by connecting to over localhost.

[jorgia111]

here is my task definition template ,fyi I have the API key stored in aws secret manager ,any help would help thanks

TaskDefinition:
Type: AWS::ECS::TaskDefinition
UpdateReplacePolicy: Retain
Properties:
Family: !Ref StackName
TaskRoleArn: !GetAtt TaskRole.Arn
ExecutionRoleArn: !GetAtt TaskExecutionServiceRole.Arn
RequiresCompatibilities:
- FARGATE
NetworkMode: awsvpc
Cpu: !Ref ContainerCpu
Memory: !Ref ContainerMemory
ContainerDefinitions:
- Name: !Ref ContainerName
Essential: true
Image: !Ref DockerImage
Command:
- /tsrecorder
- !Sub "--dst=s3://s3.${AWS::Region}.${AWS::URLSuffix}"
- !Sub "--bucket=${Bucket}"
- --ui
- --statedir=/data
StopTimeout: 30
LogConfiguration:
LogDriver: awslogs
Options:
awslogs-group: !Ref CloudWatchLogsGroup
awslogs-region: !Ref AWS::Region
awslogs-stream-prefix: ecs
PortMappings:
- ContainerPort: !Ref ContainerPort
HostPort: !Ref ContainerPort
Secrets:
- Name: TS_AUTHKEY
ValueFrom: !Sub "${TailscaleKey}:TS_AUTHKEY::"
LinuxParameters:
InitProcessEnabled: true

[jorgia111]

@maisem any chance ?

[maisem]

has the authkey expired? was it a single use key? can you try using a new authkey