Service Failed to Launch a Task - amazon-web-services

Question

I am trying to deploy a CloudFormation template that defines a ECS cluster, service, and task definition. When the service tries to start a task, it gives the following error:
service ECSService failed to launch a task with (error ECS was unable to assume the role 'arn:aws:iam:::role/ExecutionRole' that was provided for this task. Please verify that the role being passed has the proper trust relationship and permissions and that your IAM user has permissions to pass this role.).
I define the role as:
ExecutionRole:
Type: AWS::IAM::Role
Properties:
RoleName: ExecutionRole
AssumeRolePolicyDocument:
Statement:
- Effect: Allow
Action: sts:AssumeRole
Principal:
Service: ecs-tasks.amazonaws.com
ManagedPolicyArns:
- arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy
Path: /myroles
And the service:
Cluster:
Type: AWS::ECS::Cluster
Properties:
ClusterName: Cluster
Service:
Type: AWS::ECS::Service
DependsOn:
- ExecutionRole
Properties:
Cluster: !Ref Cluster
DesiredCount: 1
LaunchType: FARGATE
NetworkConfiguration:
AwsvpcConfiguration:
AssignPublicIp: ENABLED
SecurityGroups:
- !Ref SecurityGroup
Subnets:
- !Ref PublicSubnet
ServiceName: ECSService
TaskDefinition: !Ref TaskDefinition
TaskDefinition:
Type: AWS::ECS::TaskDefinition
Properties:
ContainerDefinitions:
- Name: Container
Image: !Ref TaskImage
Cpu: .25 vCPU
ExecutionRoleArn: !Ref ExecutionRole
Family: GoCapture
Memory: 0.5 GB
NetworkMode: awsvpc
RuntimePlatform:
CpuArchitecture: X86_64
OperatingSystemFamily: LINUX
This all seems to match the documentation. But clearly I have something wrong. What am I missing?
For reference, the full template is here. I only changed some names in the copied version here. But otherwise it should be the same at the time I originally wrote this question. Any other differences are due to pushing changes to my branch to try them out.

Answer 1

In the github version you have Path: /gocapture/, while in SO you don't have it. Thus as I wrote earlier, your code in question is different then your actual code.
I modify your code to remove Path: /gocapture/.
Parameters:
TaskImage:
Type: String
Resources:
ExecutionRole:
Type: AWS::IAM::Role
Properties:
RoleName: GoCaptureExecutionRole
AssumeRolePolicyDocument:
Statement:
- Effect: Allow
Action: sts:AssumeRole
Principal:
Service: ecs-tasks.amazonaws.com
ManagedPolicyArns:
- arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy
#Path: /gocapture/
TaskRole:
Type: AWS::IAM::Role
Properties:
RoleName: GoCaptureTaskRole
AssumeRolePolicyDocument:
Statement:
- Effect: Allow
Action: sts:AssumeRole
Principal:
Service: ecs-tasks.amazonaws.com
#Path: /gocapture/
Vpc:
Type: AWS::EC2::VPC
Properties:
CidrBlock: 10.0.0.0/16
SecurityGroup:
Type: AWS::EC2::SecurityGroup
Properties:
GroupName: GoCaptureSecurityGroup
GroupDescription: Security Group for Go Capture ECS Service
VpcId: !Ref Vpc
PublicSubnet:
Type: AWS::EC2::Subnet
Properties:
CidrBlock: 10.0.0.0/16
VpcId: !Ref Vpc
Cluster:
Type: AWS::ECS::Cluster
Properties:
ClusterName: GoCaptureCluster
Service:
Type: AWS::ECS::Service
Properties:
Cluster: !Ref Cluster
DesiredCount: 1
LaunchType: FARGATE
NetworkConfiguration:
AwsvpcConfiguration:
AssignPublicIp: ENABLED
SecurityGroups:
- !Ref SecurityGroup
Subnets:
- !Ref PublicSubnet
ServiceName: GoCaptureECSService
TaskDefinition: !Ref TaskDefinition
TaskDefinition:
Type: AWS::ECS::TaskDefinition
Properties:
ContainerDefinitions:
- Name: GoCaptureContainer
Image: !Ref TaskImage
Cpu: .25 vCPU
ExecutionRoleArn: !Ref ExecutionRole
Family: GoCapture
Memory: 0.5 GB
NetworkMode: awsvpc
RuntimePlatform:
CpuArchitecture: X86_64
OperatingSystemFamily: LINUX
TaskRoleArn: !Ref TaskRole