Terraform部署ECS任务定义时遇Invalid arn syntax错误求助

执行terraform apply -auto-approve部署连接RDS的ECS容器时，创建名为project_task的ECS任务定义失败，报错如下：

Error: creating ECS Task Definition (project_task): ClientException: Invalid arn syntax.
│
│   with module.ecs.aws_ecs_task_definition.project_task,
│   on modules/ecs/main.tf line 37, in resource "aws_ecs_task_definition" "project_task":
│   37: resource "aws_ecs_task_definition" "project_task" {
│

相关代码文件 #

main.tf #

data "aws_ecr_repository" "project_ecr_repo" {
  name = "project-ecr-repo"
}

resource "aws_ecs_cluster" "project_cluster" {
  name = "project-cluster"
}

data "aws_iam_policy_document" "ecs_task_execution_role" {
  version = "2012-10-17"
  statement {
    sid = ""
    effect = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["ecs-tasks.amazonaws.com"]
    }
  }
}

# ECS task execution role
resource "aws_iam_role" "ecs_task_execution_role" {
  name               = "ecs_task_execution_role"
  assume_role_policy = "${data.aws_iam_policy_document.ecs_task_execution_role.json}"
}

# ECS task execution role policy attachment
resource "aws_iam_role_policy_attachment" "ecs_task_execution_role" {
  role       = "${aws_iam_role.ecs_task_execution_role.name}"
  policy_arn = "arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy"
}

resource "aws_ecs_task_definition" "project_task" {
  family = "project_task"
  container_definitions = file("container_def.json")
  requires_compatibilities = ["FARGATE"]
  network_mode             = "awsvpc"
  memory                   = 512
  cpu                      = 256
  execution_role_arn       = aws_iam_role.ecs_task_execution_role.arn
}

resource "aws_ecs_service" "project_service" {
  name            = "project-service"
  cluster         = aws_ecs_cluster.project_cluster.id
  task_definition = aws_ecs_task_definition.project_task.arn
  launch_type     = "FARGATE"
  desired_count   = 2

  network_configuration {
    subnets          = var.vpc.public_subnets
    assign_public_ip = true
  }
}

container_def.json #

[
        {
            "name": "backend_feed",
            "image": "639483503131.dkr.ecr.us-east-1.amazonaws.com/backend-feed:latest",
            "cpu": 256,
            "memory": 512,
            "portMappings": [
                {
                    "containerPort": 8080,
                    "hostPort": 8080,
                    "protocol": "tcp"
                }
            ],
            "environmentFiles": [
                {
                    "value": "https://myawsbucket-639483503131.s3.amazonaws.com/env_vars.json",
                    "type": "s3"
                }
            ]
        }
]

排查与修复 #

报错提示ARN语法无效，核心问题出在container_def.json里的environmentFiles配置：

当使用S3作为环境文件来源时，value字段必须填写S3对象的ARN，而不是HTTP URL。当前配置用了https://myawsbucket-639483503131.s3.amazonaws.com/env_vars.json，不符合要求。

修复步骤： #

• 将container_def.json中的environmentFiles.value替换为S3对象的ARN，格式为arn:aws:s3:::bucket-name/file-name.json
  对应你的情况，应该修改为：

  "value": "arn:aws:s3:::myawsbucket-639483503131/env_vars.json"
  

• 确保ECS任务执行角色（ecs_task_execution_role）拥有访问该S3对象的权限，当前仅附加了AmazonECSTaskExecutionRolePolicy，该策略默认包含S3读取权限，但如果你的桶有自定义权限策略，需要额外配置允许ecs-tasks.amazonaws.com读取该对象。
• 重新执行terraform apply -auto-approve即可完成部署。

内容的提问来源于stack exchange，提问作者Ahmed Omar