Permissions issues (Support cases, S3 Objects, ECS clusters, etc) - Docker on ECS

[dfeldstarsky]

Hiya - love the app and dashboard. Running into some issues similar to #85 and other permissions issues.

I can't see ECS clusters, S3 object size, number of support cases, etc. I have attached your komiser policy to the ECS workspace role and most of the permissions are working!

Permission issues shown. 0 bucket size for s3 shown.

I am deploying on ECS Fargate, with a task definition attached.

Logs showing 500 errors:

Task def json:

[
    {
        "name": "komiser-task-def",
        "image": "<acc_name>.dkr.ecr.us-west-2.amazonaws.com/komiser:latest",
        "cpu": 512,
        "memory": 1024,
        "essential": true,
        "portMappings": [
            {
                "containerPort": 80,
                "hostPort": 80,
                "protocol": "tcp"
            },
            {
                "containerPort": 3000,
                "hostPort": 3000,
                "protocol": "tcp"
            }
        ],
        "logConfiguration": {
            "logDriver": "awslogs",
            "options": {
                "awslogs-group": "/aws/ecs/komiser",
                "awslogs-region": "us-west-2",
                "awslogs-stream-prefix": "komiser"
            }
        },
        "healthCheck": {
            "command": ["CMD-SHELL", "curl -f http://localhost || exit 1"],
            "interval": 30,
            "retries": 2,
            "timeout": 5
        },

        "environment": [
                    {
                        "name":"PORT",
                        "value":"80"
                    },
                    {
                        "name":"AWS_DEFAULT_REGION",
                        "value":"us-west-2"
                    }

                ],

        "mountPoints": [],
        "volumesFrom": []
    }
]

[dfeldstarsky]

Seem to have the right environment variables:

[mlabouardy]

Hello @dfeldstarsky , thanks for reporting this out.

You need to add ""s3:GetBucketLocation"" permission to the IAM role :)

[mlabouardy]

I have updated the IAM policy with the missing permissions: https://github.com/mlabouardy/komiser/blob/master/policy.json

Let me know, if that fix your issues

[dfeldstarsky]

@mlabouardy thanks so much for the quick reply + suggested fix. I applied the permissions change from your new policy and indeed I now get all the S3 metrics :).

Now the only permissions problems I see are AWS Support cases and correct ECS cluster counts. Cluster counts is still at 0 despite us having ~5. And we have 2 open AWS support cases.

Current 500 errors:

[mlabouardy]

@dfeldstarsky you can fix AWS support cases issue by using "support:*" (I have updated the IAM policy)

[mlabouardy]

@dfeldstarsky I was able to reproduce the issue regarding ECS clusters, I will fix that by the end of today, meanwhile, I will close this ticket, and I let you raise an issue regarding ECS if you dont mind :)

[dfeldstarsky]

Done, opened a new issue 👍