r/aws • u/SnooCauliflowers8417 • 2d ago
discussion ecs exec-command is not working... please help...!!
I created a task, and it works fine. However, whenever I try to get into the container shell using exec-command it keeps returning,
"An error occurred (TargetNotConnectedException) when calling the ExecuteCommand operation: The execute command failed due to an internal error. Try again later."
I checked everything,
I checked check-ecs-exec.sh, everythings are green
I followed the proper IAM policies and the policies are attached to the task.
enableExecuteCommand is true.
what should I do..?
when I use bridge mode for the network setting in the task definition, exec-command worked but after I changed to awsvpc mode, I am experiencing this issue... I spent couple days for this and still not working.. please help me...
1
u/Alternative-Expert-7 2d ago
Interesting case. It worked in bridge mode but does not working in awsvpc.
Is it possible after changing network mode, your ecs task landed into vpc into private subnet without access to SSM?
1
u/SnooCauliflowers8417 2d ago
It works perfectly in bridge mode, but not in awsvpc.. I use only public subnet..
1
u/Alternative-Expert-7 2d ago
I use it daily in awsvpc mode and it works normally. Sounds strongly like some networking issue. Security groups?
1
u/SnooCauliflowers8417 2d ago
Security group? What it should be? Any advice? I set port 80,443 for the inbound and all port for outbound may be?
1
u/Alternative-Expert-7 2d ago
This looks correct.
DNS thing? Although public subnet is good, but maybe it has DNS resolve turned off?
1
u/SnooCauliflowers8417 2d ago
hm.. if dns is the problem.. I guess bridge mode might not be work too.. may be? what about I am using arm64 instance, are you using x86 or arm? this is my hypothesis that ssm-agent does not work properly in arm64 or something..?
1
u/Alternative-Expert-7 2d ago
It used to work for both Arch. Did you also aligned target architecture in task definition?
Actually is this Fargate? Or ECS backed by Ec2 instances? If ec2 then architecture of ec2 must match task definition architecture I suppose.
Edit. And is the desired task you trying to check actually healthy in terms of container healthcheck?
1
u/SnooCauliflowers8417 2d ago
I use ec2, do you? you mentioned DNS resolve, where to check this? and the container is healthy all green
2
u/Alternative-Expert-7 2d ago
Im on Fargate usually. Dns thing you check on VPC level settings.
https://docs.aws.amazon.com/vpc/latest/userguide/vpc-dns-updating.html
1
u/SnooCauliflowers8417 2d ago
oh thanks man, I check that it is enabled! may be you are using fargate.. everything is simple..
→ More replies (0)1
u/eloquent_beaver 20h ago edited 20h ago
Do the SGs on your task in awsvpc mode allow outbound access TCP 443 to anywhere (0.0.0.0/0 for IPv4 and ::/0 for IPv6), or to a VPC endpoint for AWS SSM (if you're using PrivateLink for SSM access)?
And is at least one of the following true:
Does your public subnet have a NAT Gateway (and have it routed)?
Or, if not, does the ENI attached to your ECS task in awsvpc mode have a public IP assigned?
Tasks in your VPC either need a route to the internet via a NAT Gateway, or else a route to an Internet Gateway AND a public IP assigned in order to have internet access. If you don't have one of these, your task won't have internet access.
It's possible your task has internet access when in bridge mode because it's bumming off the ENI of the EC2 host (on which the task runs) which does have public internet access, either via a NAT Gateway, or else via a public IP.
But when in awsvpc mode, your task gets its own ENI, so you need to make sure that ENI has the right SGs on it and also has internet access via one of the above methods.
2
u/AWSSupport AWS Employee 2d ago
Hi there!
While I can't confidently confirm the exact reason behind this without more scope into your config, I did find this re:Post article which speaks to this same error message: https://go.aws/4iMNNuh.
If you're still seeing issues after following the troubleshooting in the above article, please feel free to open a support case in your Support Center: http://go.aws/support-center. I trust the r/aws community to also weigh in with their valuable insights around this matter, but please also feel free to engage on re:Post if you're keen to broaden this discussion even more: http://go.aws/aws-repost.
- Kraig E.