使用 Boto3 无法在 Fargate 容器中找到凭据

Question

I am trying to create a container that splits files and then uploads them to S3 container. The process works as intended, but when trying to send the file to S3 it fails with the error Unable to locate credentials inside fargate container .

My dockerfile looks like this:

FROM python:3.8-slim

RUN apt-get update \
    && apt-get install -y wget \
    && rm -rf /var/lib/apt/lists/*

RUN mkdir /tmp/splitter

RUN pip install --upgrade pip && \
    pip install --no-cache-dir requests boto3

RUN wget -O /tmp/init.sh (WHATEVER) \
    && chmod +x /tmp/init.sh

CMD /tmp/init.sh

I have my role set up like the ecsTaskExecutionRole that appears in Amazon's documentation .

Answer 1

ecsTaskExecutionRole is not for your container to access S3. It is for ECS itself to be able to, eg pull your docker image from ECR.

For your application permissions in the container, you need a task role , not the task execution role. It can be confusing because both are named similarly and both have same trust policy.

The task role can be specified along task execution role:

The roles can also be set at task definition level: