GetSSMParams empty?

[rickytato]

Description

Please provide a clear and concise description of the issue you are encountering, and a reproduction of your configuration (see the examples/* directory for references that you can copy+paste and tailor to match your configs if you are unable to copy your exact configuration). The reproduction MUST be executable by running terraform init && terraform apply without any further changes.

If your request is for a new feature, please use the Feature request template.

• ✋ I have searched the open/closed issues and my issue is not listed.

Versions

• Module version [Required]:
  6.2.1

• Terraform version:
  tofu@fe6462a35296:/$ tofu providers -version
  OpenTofu v1.10.5
  on linux_amd64

• Provider version(s):
  tofu@fe6462a35296:/$ tofu providers -version
  OpenTofu v1.10.5
  on linux_amd64

Reproduction Code [Required]

inputs = {
    cluster_name        = "ecs-cluster-${local.environment}"
    capacity_providers  = ["FARGATE", "FARGATE_SPOT"]
    container_insights  = true
    task_exec_ssm_param_arns = [
        "arn:aws:ssm:${local.aws_region}:${local.aws_account_id}:parameter/rds/mlflow/user",
        "arn:aws:ssm:${local.aws_region}:${local.aws_account_id}:parameter/rds/mlflow/pass",
        "arn:aws:ssm:${local.aws_region}:${local.aws_account_id}:parameter/rds/mlflow/endpoint"
    ]

Steps to reproduce the behavior:

I'm using opentofu and terragrunt

Expected behavior

Task Role are empy
Task Execution Role have only CloudWatch and ECR permissions without SSM Action:

terraform-aws-ecs/modules/service/main.tf

Line 1083 in 2afaaaf

dynamic "statement" {

{
    "Statement": [
        {
            "Action": [
                "logs:PutLogEvents",
                "logs:CreateLogStream"
            ],
            "Effect": "Allow",
            "Resource": "*",
            "Sid": "Logs"
        },
        {
            "Action": [
                "ecr:GetDownloadUrlForLayer",
                "ecr:GetAuthorizationToken",
                "ecr:BatchGetImage",
                "ecr:BatchCheckLayerAvailability"
            ],
            "Effect": "Allow",
            "Resource": "*",
            "Sid": "ECR"
        }
    ],
    "Version": "2012-10-17"
}

[bryantbiggs]

I have no idea what any of that means - we won't be able to help without a reproduction

[rickytato]

I'm using this code to Deploy on ECS; the problem is that the task doesn't have permission to get secrets from SSM; permissions set by task_exec_ssm_param_arns are not created in IAM Roles.

terraform {
    source = "${local.base_source_url}//?version=6.2.1"
}

locals {
    account_vars      = read_terragrunt_config(find_in_parent_folders("account.hcl"))
    environment_vars  = read_terragrunt_config(find_in_parent_folders("environment.hcl"))

    application     = local.environment_vars.locals.application
    aws_account_id  = local.account_vars.locals.aws_account_id
    aws_region      = local.account_vars.locals.aws_region
    customer        = local.account_vars.locals.customer
    domain          = local.environment_vars.locals.domain
    environment     = local.environment_vars.locals.environment

    base_source_url = "tfr:///terraform-aws-modules/ecs/aws"
}

dependency "s3_mlflow-artifacts" {
  config_path = dirname(find_in_parent_folders("s3/mlflow-artifacts/terragrunt.hcl"))
}

dependency "s3_configurations" {
  config_path = dirname(find_in_parent_folders("s3/configurations/terragrunt.hcl"))
}

dependency "vpc" {
  config_path = dirname(find_in_parent_folders("vpc/terragrunt.hcl"))
}

inputs = {
    cluster_name        = "ecs-cluster-${local.environment}"
    capacity_providers  = ["FARGATE", "FARGATE_SPOT"]
    container_insights  = true

    cloudwatch_log_group_retention_in_days = local.environment == "dev" || local.environment == "stage" ? 30 : 180

    task_exec_ssm_param_arns = [
        "arn:aws:ssm:${local.aws_region}:${local.aws_account_id}:parameter/rds/mlflow/user",
        "arn:aws:ssm:${local.aws_region}:${local.aws_account_id}:parameter/rds/mlflow/pass",
        "arn:aws:ssm:${local.aws_region}:${local.aws_account_id}:parameter/rds/mlflow/endpoint"
    ]

    default_capacity_provider_strategy = {
        FARGATE = {
            weight = 50
            base   = 20
        }
        FARGATE_SPOT = {
            weight = 50
        }
    }

    services = {
        mlflow = {
            # Container definition(s)
            container_definitions = {
                mlflow = {
                    cpu         = 1024
                    memory      = 2048
                    essential   = true
                    #image       = "ghcr.io/mlflow/mlflow"
                    image     = "${local.aws_account_id}.dkr.ecr.${local.aws_region}.amazonaws.com/mlflow:${local.environment}"
                    # entryPoint = ["/bin/sh", "-c"]
                    # command = [
                    #     "mlflow server --backend-store-uri mysql+pymysql://$DB_USER:$DB_PASS@$DB_URI --default-artifact-root s3://$ARTIFACT_ROOT --host 0.0.0.0 --port 5000"
                    # ]
                    environment = [
                        {
                            name  = "ARTIFACT_ROOT",
                            value = dependency.s3_mlflow-artifacts.outputs.s3_bucket_id
                        },
                        {
                            name  = "CONFIGURATION_BUCKET",
                            value = dependency.s3_configurations.outputs.s3_bucket_id
                        }
                    ]
                    secrets = [
                        {
                            name = "DB_USER"
                            valueFrom = "arn:aws:ssm:${local.aws_region}:${local.aws_account_id}:parameter/rds/mlflow/user"
                        },
                        {
                            name = "DB_PASS"
                            valueFrom = "arn:aws:ssm:${local.aws_region}:${local.aws_account_id}:parameter/rds/mlflow/pass"
                        },
                        {
                            name = "DB_URI"
                            valueFrom = "arn:aws:ssm:${local.aws_region}:${local.aws_account_id}:parameter/rds/mlflow/endpoint"
                        },
                    ]
                }
            }

            subnet_ids = dependency.vpc.outputs.private_subnets

            security_group_ingress_rules = {
                alb_5000 = {
                description                  = "Service port"
                from_port                    = 5000
                ip_protocol                  = "tcp"
                referenced_security_group_id = dependency.vpc.outputs.default_security_group_id
                }
            }
            security_group_egress_rules = {
                all = {
                    ip_protocol = "-1"
                    cidr_ipv4   = "0.0.0.0/0"
                }
            }
        }
    }
    

    tags = {
        terraform = "true"
    }
}

[rickytato]

This is the plan output (about IAM):

13:17:11.130 STDOUT tofu:   # module.service["mlflow"].aws_iam_policy.task_exec[0] will be created
13:17:11.130 STDOUT tofu:   + resource "aws_iam_policy" "task_exec" {
13:17:11.130 STDOUT tofu:       + arn              = (known after apply)
13:17:11.130 STDOUT tofu:       + attachment_count = (known after apply)
13:17:11.130 STDOUT tofu:       + description      = "Task execution role IAM policy"
13:17:11.130 STDOUT tofu:       + id               = (known after apply)
13:17:11.130 STDOUT tofu:       + name             = (known after apply)
13:17:11.131 STDOUT tofu:       + name_prefix      = "mlflow-"
13:17:11.131 STDOUT tofu:       + path             = "/"
13:17:11.131 STDOUT tofu:       + policy           = jsonencode(
13:17:11.131 STDOUT tofu:             {
13:17:11.131 STDOUT tofu:               + Statement = [
13:17:11.131 STDOUT tofu:                   + {
13:17:11.131 STDOUT tofu:                       + Action   = [
13:17:11.131 STDOUT tofu:                           + "logs:PutLogEvents",
13:17:11.131 STDOUT tofu:                           + "logs:CreateLogStream",
13:17:11.131 STDOUT tofu:                         ]
13:17:11.131 STDOUT tofu:                       + Effect   = "Allow"
13:17:11.131 STDOUT tofu:                       + Resource = "*"
13:17:11.131 STDOUT tofu:                       + Sid      = "Logs"
13:17:11.131 STDOUT tofu:                     },
13:17:11.131 STDOUT tofu:                   + {
13:17:11.131 STDOUT tofu:                       + Action   = [
13:17:11.131 STDOUT tofu:                           + "ecr:GetDownloadUrlForLayer",
13:17:11.131 STDOUT tofu:                           + "ecr:GetAuthorizationToken",
13:17:11.131 STDOUT tofu:                           + "ecr:BatchGetImage",
13:17:11.131 STDOUT tofu:                           + "ecr:BatchCheckLayerAvailability",
13:17:11.131 STDOUT tofu:                         ]
13:17:11.131 STDOUT tofu:                       + Effect   = "Allow"
13:17:11.131 STDOUT tofu:                       + Resource = "*"
13:17:11.131 STDOUT tofu:                       + Sid      = "ECR"
13:17:11.131 STDOUT tofu:                     },
13:17:11.131 STDOUT tofu:                 ]
13:17:11.131 STDOUT tofu:               + Version   = "2012-10-17"
13:17:11.131 STDOUT tofu:             }
13:17:11.131 STDOUT tofu:         )
13:17:11.131 STDOUT tofu:       + policy_id        = (known after apply)
13:17:11.131 STDOUT tofu:       + tags             = {
13:17:11.131 STDOUT tofu:           + "terraform" = "true"
13:17:11.131 STDOUT tofu:         }
13:17:11.131 STDOUT tofu:       + tags_all         = {
13:17:11.131 STDOUT tofu:           + "terraform" = "true"
13:17:11.131 STDOUT tofu:         }
13:17:11.131 STDOUT tofu:     }
13:17:11.131 STDOUT tofu:   # module.service["mlflow"].aws_iam_role.task_exec[0] will be created
13:17:11.131 STDOUT tofu:   + resource "aws_iam_role" "task_exec" {
13:17:11.131 STDOUT tofu:       + arn                   = (known after apply)
13:17:11.131 STDOUT tofu:       + assume_role_policy    = jsonencode(
13:17:11.131 STDOUT tofu:             {
13:17:11.131 STDOUT tofu:               + Statement = [
13:17:11.131 STDOUT tofu:                   + {
13:17:11.131 STDOUT tofu:                       + Action    = "sts:AssumeRole"
13:17:11.132 STDOUT tofu:                       + Effect    = "Allow"
13:17:11.132 STDOUT tofu:                       + Principal = {
13:17:11.132 STDOUT tofu:                           + Service = "ecs-tasks.amazonaws.com"
13:17:11.132 STDOUT tofu:                         }
13:17:11.132 STDOUT tofu:                       + Sid       = "ECSTaskExecutionAssumeRole"
13:17:11.132 STDOUT tofu:                     },
13:17:11.132 STDOUT tofu:                 ]
13:17:11.132 STDOUT tofu:               + Version   = "2012-10-17"
13:17:11.132 STDOUT tofu:             }
13:17:11.132 STDOUT tofu:         )
13:17:11.132 STDOUT tofu:       + create_date           = (known after apply)
13:17:11.132 STDOUT tofu:       + description           = "Task execution role for mlflow"
13:17:11.132 STDOUT tofu:       + force_detach_policies = true
13:17:11.132 STDOUT tofu:       + id                    = (known after apply)
13:17:11.132 STDOUT tofu:       + managed_policy_arns   = (known after apply)
13:17:11.132 STDOUT tofu:       + max_session_duration  = 3600
13:17:11.132 STDOUT tofu:       + name                  = (known after apply)
13:17:11.132 STDOUT tofu:       + name_prefix           = "mlflow-"
13:17:11.132 STDOUT tofu:       + path                  = "/"
13:17:11.132 STDOUT tofu:       + tags                  = {
13:17:11.132 STDOUT tofu:           + "terraform" = "true"
13:17:11.132 STDOUT tofu:         }
13:17:11.132 STDOUT tofu:       + tags_all              = {
13:17:11.132 STDOUT tofu:           + "terraform" = "true"
13:17:11.132 STDOUT tofu:         }
13:17:11.132 STDOUT tofu:       + unique_id             = (known after apply)
13:17:11.133 STDOUT tofu:       + inline_policy (known after apply)
13:17:11.133 STDOUT tofu:     }
13:17:11.133 STDOUT tofu:   # module.service["mlflow"].aws_iam_role.tasks[0] will be created
13:17:11.133 STDOUT tofu:   + resource "aws_iam_role" "tasks" {
13:17:11.133 STDOUT tofu:       + arn                   = (known after apply)
13:17:11.133 STDOUT tofu:       + assume_role_policy    = jsonencode(
13:17:11.133 STDOUT tofu:             {
13:17:11.133 STDOUT tofu:               + Statement = [
13:17:11.133 STDOUT tofu:                   + {
13:17:11.133 STDOUT tofu:                       + Action    = "sts:AssumeRole"
13:17:11.133 STDOUT tofu:                       + Condition = {
13:17:11.133 STDOUT tofu:                           + ArnLike      = {
13:17:11.133 STDOUT tofu:                               + "aws:SourceArn" = "arn:aws:ecs:eu-central-1:000000000000:*"
13:17:11.133 STDOUT tofu:                             }
13:17:11.133 STDOUT tofu:                           + StringEquals = {
13:17:11.133 STDOUT tofu:                               + "aws:SourceAccount" = "000000000000"
13:17:11.133 STDOUT tofu:                             }
13:17:11.133 STDOUT tofu:                         }
13:17:11.133 STDOUT tofu:                       + Effect    = "Allow"
13:17:11.133 STDOUT tofu:                       + Principal = {
13:17:11.133 STDOUT tofu:                           + Service = "ecs-tasks.amazonaws.com"
13:17:11.133 STDOUT tofu:                         }
13:17:11.133 STDOUT tofu:                       + Sid       = "ECSTasksAssumeRole"
13:17:11.133 STDOUT tofu:                     },
13:17:11.133 STDOUT tofu:                 ]
13:17:11.133 STDOUT tofu:               + Version   = "2012-10-17"
13:17:11.133 STDOUT tofu:             }
13:17:11.133 STDOUT tofu:         )
13:17:11.133 STDOUT tofu:       + create_date           = (known after apply)
13:17:11.133 STDOUT tofu:       + force_detach_policies = true
13:17:11.133 STDOUT tofu:       + id                    = (known after apply)
13:17:11.133 STDOUT tofu:       + managed_policy_arns   = (known after apply)
13:17:11.134 STDOUT tofu:       + max_session_duration  = 3600
13:17:11.134 STDOUT tofu:       + name                  = (known after apply)
13:17:11.134 STDOUT tofu:       + name_prefix           = "mlflow-"
13:17:11.134 STDOUT tofu:       + path                  = "/"
13:17:11.134 STDOUT tofu:       + tags                  = {
13:17:11.134 STDOUT tofu:           + "terraform" = "true"
13:17:11.134 STDOUT tofu:         }
13:17:11.134 STDOUT tofu:       + tags_all              = {
13:17:11.134 STDOUT tofu:           + "terraform" = "true"
13:17:11.134 STDOUT tofu:         }
13:17:11.134 STDOUT tofu:       + unique_id             = (known after apply)
13:17:11.134 STDOUT tofu:       + inline_policy (known after apply)
13:17:11.134 STDOUT tofu:     }
13:17:11.134 STDOUT tofu:   # module.service["mlflow"].aws_iam_role_policy_attachment.task_exec[0] will be created
13:17:11.134 STDOUT tofu:   + resource "aws_iam_role_policy_attachment" "task_exec" {
13:17:11.134 STDOUT tofu:       + id         = (known after apply)
13:17:11.134 STDOUT tofu:       + policy_arn = (known after apply)
13:17:11.134 STDOUT tofu:       + role       = (known after apply)
13:17:11.134 STDOUT tofu:     }

[bryantbiggs]

clearly something is wrong with your configuration, but I can't decipher what you've provided

[rickytato]

clearly something is wrong with your configuration, but I can't decipher what you've provided

I think the problem here in the service module?

terraform-aws-ecs/modules/service/main.tf

Line 1083 in 2afaaaf

dynamic "statement" {

  dynamic "statement" {
    for_each = length(var.task_exec_ssm_param_arns) > 0 ? [1] : []

    content {
      sid       = "GetSSMParams"
      actions   = ["ssm:GetParameters"]
      resources = var.task_exec_ssm_param_arns
    }
  }

Maybe not read correctly this?

    task_exec_ssm_param_arns = [
        "arn:aws:ssm:${local.aws_region}:${local.aws_account_id}:parameter/rds/mlflow/user",
        "arn:aws:ssm:${local.aws_region}:${local.aws_account_id}:parameter/rds/mlflow/pass",
        "arn:aws:ssm:${local.aws_region}:${local.aws_account_id}:parameter/rds/mlflow/endpoint"
    ]

I'm using directly the module without specify sub-mobules...

[github-actions]

This issue has been automatically marked as stale because it has been open 30 days
with no activity. Remove stale label or comment or this issue will be closed in 10 days