在ECS集群创建服务时触发Deployment Circuit Breaker错误求助

问题描述 #

部署NoteAppService时出错。资源处理程序消息："操作'ECS Deployment Circuit Breaker was triggered'遇到错误。"（RequestToken: a9b4170a-b382-355d-0dc5-ae55cc25d314，HandlerErrorCode: GeneralServiceException）

多次尝试在ECS集群中基于指定Task Definition创建NoteAppService服务均失败，无法定位具体原因及解决方法。

Task Definition配置 #

{
  "taskDefinitionArn": "arn:aws:ecs:us-east-1:755204033406:task-definition/NoteappTaskDefin:1",
  "containerDefinitions": [
    {
      "name": "Container1",
      "image": "public.ecr.aws/d4a1q9y6/note_app_public_repo",
      "cpu": 0,
      "portMappings": [
        {
          "name": "container1-3000-tcp",
          "containerPort": 3000,
          "hostPort": 3000,
          "protocol": "tcp",
          "appProtocol": "http"
        }
      ],
      "essential": true,
      "environment": [],
      "environmentFiles": [],
      "mountPoints": [],
      "volumesFrom": [],
      "ulimits": [],
      "logConfiguration": {
        "logDriver": "awslogs",
        "options": {
          "awslogs-create-group": "true",
          "awslogs-group": "/ecs/NoteappTaskDefin",
          "awslogs-region": "us-east-1",
          "awslogs-stream-prefix": "ecs"
        },
        "secretOptions": []
      }
    }
  ],
  "family": "NoteappTaskDefin",
  "executionRoleArn": "arn:aws:iam::755204033406:role/ecsTaskExecutionRole",
  "networkMode": "awsvpc",
  "revision": 1,
  "volumes": [],
  "status": "ACTIVE",
  "requiresAttributes": [
    {
      "name": "com.amazonaws.ecs.capability.logging-driver.awslogs"
    },
    {
      "name": "ecs.capability.execution-role-awslogs"
    },
    {
      "name": "com.amazonaws.ecs.capability.docker-remote-api.1.19"
    },
    {
      "name": "com.amazonaws.ecs.capability.docker-remote-api.1.18"
    },
    {
      "name": "ecs.capability.task-eni"
    },
    {
      "name": "com.amazonaws.ecs.capability.docker-remote-api.1.29"
    }
  ],
  "placementConstraints": [],
  "compatibilities": [
    "EC2",
    "FARGATE"
  ],
  "requiresCompatibilities": [
    "EC2"
  ],
  "cpu": "1024",
  "memory": "3072",
  "runtimePlatform": {
    "cpuArchitecture": "X86_64",
    "operatingSystemFamily": "LINUX"
  },
  "registeredAt": "2023-08-22T09:37:03.162Z",
  "registeredBy": "arn:aws:iam::755204033406:root",
  "tags": []
}

排查与解决步骤 #

• 检查ECS集群资源：确认集群内EC2实例剩余CPU（1024单位=1vCPU）和内存（3072MiB）是否满足任务配置需求，资源不足会导致任务启动失败触发熔断。
• 验证任务执行角色权限：确保ecsTaskExecutionRole具备拉取ECR镜像的权限（可附加AmazonEC2ContainerRegistryReadOnly策略），以及写入CloudWatch日志的权限（可附加CloudWatchLogsFullAccess或自定义细粒度权限）。
• 测试镜像可用性：本地执行docker pull public.ecr.aws/d4a1q9y6/note_app_public_repo，确认镜像可正常拉取且能启动。
• 查看CloudWatch日志：进入CloudWatch控制台，找到日志组/ecs/NoteappTaskDefin，查看任务启动失败的具体日志信息（如应用启动报错、端口冲突等）。
• 核对网络配置：因使用awsvpc网络模式，需确认EC2实例所在安全组允许3000端口的出入站流量，同时任务配置的子网、安全组需与集群网络匹配。
• 临时调整熔断策略（测试用）：若需快速验证，可在服务部署设置中调高熔断失败阈值，但需尽快定位根本原因，不建议长期使用该方式。

内容的提问来源于stack exchange，提问作者Saksham Paliwal