AWS Fargate ECS容器无法启动SSM远程主机端口转发会话，实例正常

问题背景 #

在EC2实例上可正常通过SSM启动到远程主机的端口转发会话，但在Fargate ECS容器上执行相同逻辑的命令失败，AWS控制台未明确所需配置。

EC2上可正常运行的命令 #

aws ssm start-session \
--target i-{instance} \
--region {region} \
--profile {profile} \
--document-name AWS-StartPortForwardingSessionToRemoteHost \
--parameters '{"portNumber":["22"],"localPortNumber":["9999"],"host":["{host}"]}'

Fargate容器上无法运行的命令 #

aws ssm start-session \
--target ecs:{clusterName}_{taskId}_{containerRuntimeId} \
--region {region} \
--profile {profile} \
--document-name AWS-StartPortForwardingSessionToRemoteHost \
--parameters '{"portNumber":["22"],"localPortNumber":["9999"],"host":["{PrivateIPofClusterTask}"]}'

已为ECS任务IAM角色附加以下策略：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ssm:StartSession",
                "ecs:ExecuteCommand"
            ],
            
            "Resource": [
                "arn:aws:ecs:blablabla:cluster/{clusterName}",
                "arn:aws:ssm:blablabla::document/AWS-StartInteractiveCommand",
                "arn:aws:ssm:blablabla::document/AWS-StartPortForwardingSession",
                "arn:aws:ssm:blablabla::document/AWS-StartPortForwardingSessionToRemoteHost",
                "arn:aws:ssm:blablabla::document/AWS-StartSSHSession"
            ]
        }
    ]
}

解决步骤 #

1. 修正IAM策略资源与权限范围 #

当前策略缺少ECS任务本身的资源授权，且缺少SSM会话通信必需的动作权限，需更新为：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ssm:StartSession",
                "ecs:ExecuteCommand",
                "ssm:UpdateInstanceInformation",
                "ssmmessages:CreateControlChannel",
                "ssmmessages:CreateDataChannel",
                "ssmmessages:OpenControlChannel",
                "ssmmessages:OpenDataChannel"
            ],
            "Resource": [
                "arn:aws:ecs:blablabla:cluster/{clusterName}",
                "arn:aws:ecs:blablabla:task/{clusterName}/*",
                "arn:aws:ssm:blablabla::document/AWS-StartInteractiveCommand",
                "arn:aws:ssm:blablabla::document/AWS-StartPortForwardingSession",
                "arn:aws:ssm:blablabla::document/AWS-StartPortForwardingSessionToRemoteHost",
                "arn:aws:ssm:blablabla::document/AWS-StartSSHSession"
            ]
        }
    ]
}

• arn:aws:ecs:blablabla:task/{clusterName}/* 授权集群下所有任务，也可指定单个任务ARN缩小范围
• 添加的ssmmessages系列动作是SSM会话建立与通信的必需权限

2. 确认Fargate任务基础配置 #

• 任务平台版本需为1.4.0及以上，该版本开始支持SSM会话管理
• 任务定义中需设置enableExecuteCommand=true，确保开启执行命令功能

3. 检查网络连通性 #

• Fargate任务所在安全组需允许出站访问目标主机的22端口
• 目标主机的安全组需允许来自Fargate任务所在VPC CIDR或任务安全组的22端口入站流量

4. 重启Fargate任务 #

修改IAM策略或任务定义后，必须重启Fargate任务，确保新配置生效

内容的提问来源于stack exchange，提问作者Raheel Hasan