AWS ECS服务任务卡在Provisioning状态故障排查求助

问题描述 #

• 配置Fargate类型任务定义：任务级分配2vCPU、4GB内存，容器预留1vCPU、2GB内存
• 关联任务启动服务后，任务始终处于Provisioning状态，容器标签页无容器信息显示
• 尝试降低容器内存配置，问题未解决

任务定义JSON #

{"taskDefinitionArn": "arn:aws:ecs:eu-west-3:1234567:task-definition/Task:9", "containerDefinitions": [{"name": "my_image_test", "image": "1234567.dkr.ecr.eu-west-3.amazonaws.com/my_image:latest", "cpu": 1024, "memoryReservation": 2048, "portMappings": [{"name": "ingestion-80-tcp", "containerPort": 80, "hostPort": 80, "protocol": "tcp", "appProtocol": "http"}], "essential": true, "environment": [{"name": "AWS_DEFAULT_REGION", "value": "eu-west-3"}], "environmentFiles": [], "mountPoints": [], "volumesFrom": [], "ulimits": [], "logConfiguration": {"logDriver": "awslogs", "options": {"awslogs-create-group": "true", "awslogs-group": "/ecs/", "awslogs-region": "eu-west-3", "awslogs-stream-prefix": "ecs"}, "secretOptions": []}}], "family": "Service Task", "executionRoleArn": "arn:aws:iam::1234567:role/ecsTaskExecutionRole", "networkMode": "awsvpc", "revision": 9, "volumes": [], "status": "ACTIVE", "requiresAttributes": [{"name": "com.amazonaws.ecs.capability.logging-driver.awslogs"}, {"name": "ecs.capability.execution-role-awslogs"}, {"name": "com.amazonaws.ecs.capability.ecr-auth"}, {"name": "com.amazonaws.ecs.capability.docker-remote-api.1.19"}, {"name": "com.amazonaws.ecs.capability.docker-remote-api.1.21"}, {"name": "ecs.capability.execution-role-ecr-pull"}, {"name": "com.amazonaws.ecs.capability.docker-remote-api.1.18"}, {"name": "ecs.capability.task-eni"}, {"name": "com.amazonaws.ecs.capability.docker-remote-api.1.29"}], "placementConstraints": [], "compatibilities": ["EC2", "FARGATE"], "requiresCompatibilities": ["FARGATE"], "cpu": "2048", "memory": "4096", "runtimePlatform": {"cpuArchitecture": "X86_64", "operatingSystemFamily": "LINUX"}, "registeredAt": "2024-02-09T11:32:31.879Z", "registeredBy": "arn:aws:iam::1234567:user/my_user", "tags": []}

排查步骤 #

1. 网络配置核查 #

• 确认任务使用的awsvpc网络模式对应的安全组，是否允许出站443端口访问（拉取ECR镜像、CloudWatch日志写入都需要）
• 检查任务部署的子网类型：私有子网必须配置NAT网关，公有子网需关联互联网网关，确保任务能出站访问AWS服务
• 验证子网路由表：私有子网路由表需指向NAT网关，公有子网需指向互联网网关

2. IAM执行角色权限验证 #

• 检查ecsTaskExecutionRole是否包含以下权限：
  • ECR镜像拉取：ecr:GetDownloadUrlForLayer、ecr:BatchGetImage、ecr:BatchCheckLayerAvailability
  • CloudWatch日志写入：logs:CreateLogStream、logs:PutLogEvents
• 确认角色信任关系已添加ecs-tasks.amazonaws.com作为信任实体

3. 镜像可用性检查 #

• 用AWS CLI命令验证ECR镜像是否存在：

  aws ecr describe-images --repository-name my_image --region eu-west-3
  

  确认latest标签对应的镜像摘要有效
• 若ECR仓库设置了资源策略，需确保ecsTaskExecutionRole被允许访问该仓库

4. Fargate规格兼容性 #

• 确认eu-west-3区域支持2vCPU/4GB的Fargate规格（Fargate官方支持2vCPU对应3GB-16GB内存，该配置合法，但需确认区域是否有资源）
• 检查任务runtimePlatform为X86_64/LINUX，确保镜像架构与之匹配（避免ARM镜像跑在X86实例上）

5. 日志与事件分析 #

• 查看ECS任务详情的Events标签，是否有镜像拉取失败、网络错误、权限不足等具体提示
• 检查CloudWatch日志组/ecs/下是否有日志生成（即使容器未启动，任务执行阶段的日志可能会在这里输出）

内容的提问来源于stack exchange，提问作者Stefano Castoldi