AWS ECS Fargate通过Terraform部署后无CloudWatch日志求助

1. 容器化应用 #

test.py:

import logging
logging.info("wow!!")

Dockerfile:

FROM python:3.10-slim
RUN apt-get update && \
    apt-get -y install git && \
    rm -rf /var/lib/apt/lists/*
COPY test.py /tmp/test.py
CMD ["python", "/tmp/test.py"]

2. 推送镜像至ECR #

$ docker push XXXXXXX.dkr.ecr.us-east-1.amazonaws.com/chois-trader:trading-latest

3. Terraform配置 #

ecs.tf:

resource "aws_kms_key" "chois_trader" {
  deletion_window_in_days = 7
}

resource "aws_cloudwatch_log_group" "chois_trader" {
  name = "chois_trader"
}

resource "aws_iam_role" "chois_trader_task_execution_role" {
  name = "chois-trader-task-execution-role"

  assume_role_policy = <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "ecs-tasks.amazonaws.com"
      },
      "Action": [
        "sts:AssumeRole"
      ]
    }
  ]
}
EOF
}

resource "aws_iam_role_policy_attachment" "chois_trader_task_execution_role_policy_attachment" {
  role       = aws_iam_role.chois_trader_task_execution_role.name
  policy_arn = "arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy"
}

resource "aws_iam_role" "chois_trader_task_role" {
  name = "chois-trader-task-role"

  assume_role_policy = jsonencode({
    "Version": "2012-10-17",
    "Statement": [
      {
        "Effect": "Allow",
        "Principal": {
          "Service": "ecs-tasks.amazonaws.com"
        },
        "Action": "sts:AssumeRole"
      }
    ]
  })
}

resource "aws_iam_policy" "chois_trader_log_policy" {
  name        = "chois-trader-log-policy"
  description = "chois trader log IAM policy"
  policy = jsonencode({
    "Version": "2012-10-17",
    "Statement": [
      {
        "Sid": "1",
        "Effect": "Allow",
        "Action": [
          "logs:CreateLogStream",
          "logs:CreateLogGroup",
          "logs:DescribeLogStreams",
          "logs:PutLogEvents"
        ],
        "Resource": "arn:aws:logs:ap-northeast-2:YYYYYYYYY:log-group:chois_trader:*"
      }
    ]
  })
}

resource "aws_iam_role_policy_attachment" "example_attachment" {
  role       = aws_iam_role.chois_trader_task_role.name
  policy_arn = aws_iam_policy.chois_trader_log_policy.arn
}

resource "aws_ecs_cluster" "chois_trader" {
  name = "chois_trader"

  configuration {
    execute_command_configuration {
      kms_key_id = aws_kms_key.chois_trader.arn
      logging    = "OVERRIDE"

      log_configuration {
        cloud_watch_encryption_enabled = true
        cloud_watch_log_group_name     = aws_cloudwatch_log_group.chois_trader.name
      }
    }
  }
}

# Create a task definition with a container image
resource "aws_ecs_task_definition" "chois_trader_task" {
  family = "chois-trader-task"
  requires_compatibilities = ["FARGATE"]
  network_mode             = "awsvpc"
  execution_role_arn       = aws_iam_role.chois_trader_task_execution_role.arn
  task_role_arn = aws_iam_role.chois_trader_task_role.arn
  cpu    = 256
  memory = 512
  container_definitions = jsonencode([
    {
      name  = "chois-trader-task-container"
      image = "XXXXXXXX.dkr.ecr.us-east-1.amazonaws.com/chois-trader:trading-latest"
      log_configuration = {
        log_driver = "awslogs"
        options = {
          "awslogs-group"         = "chois_trader"
          "awslogs-region"        = "ap-northeast-2"
          "awslogs-stream-prefix" = "ecs"
        }
      }
    }
  ])
  volume {
    name      = "service-storage"
  }
}

4. 执行Terraform部署 #

$ terraform apply

5. 任务执行情况 #

在AWS控制台手动执行任务后，任务数秒内以状态码0退出，但CloudWatch日志组中无任何日志生成。

问题 #

请问我是否遗漏了什么配置？

排查与解决方案 #

• Python日志级别未配置
  Python默认日志级别为WARNING，logging.info的输出会被过滤。需要在test.py中添加基础配置，确保日志输出到标准流：

  import logging
  logging.basicConfig(level=logging.INFO)
  logging.info("wow!!")
  

• IAM权限分配错误
  awslogs日志驱动的推送权限需要赋予任务执行角色（Execution Role），而非任务角色（Task Role）。当前日志策略附加到了chois_trader_task_role，需改为附加到chois_trader_task_execution_role；或确认AmazonECSTaskExecutionRolePolicy已包含足够的日志操作权限。

• 日志组ARN匹配问题
  检查aws_iam_policy.chois_trader_log_policy中的资源ARN：确认账号IDYYYYYYYYY与实际AWS账号一致，日志组名称完全匹配。

• 容器本地日志验证
  本地运行容器，确认标准输出/错误有内容：

  docker run --rm XXXXXXX.dkr.ecr.us-east-1.amazonaws.com/chois-trader:trading-latest
  

  若本地无输出，优先解决应用日志配置问题。

内容的提问来源于stack exchange，提问作者user3595632