AWS AmazonECS documentation change
Summary
Added troubleshooting section for ARN migration errors related to account settings
Security assessment
Addresses operational errors during ARN format migration with no direct security implications. The changes focus on resolving configuration issues rather than security vulnerabilities.
Diff
diff --git a/AmazonECS/latest/developerguide/service-arn-migration.md b/AmazonECS/latest/developerguide/service-arn-migration.md index a5563547f..cf7cf08ad 100644 --- a//AmazonECS/latest/developerguide/service-arn-migration.md +++ b//AmazonECS/latest/developerguide/service-arn-migration.md @@ -5 +5 @@ -PrerequisitesProcedure +PrerequisitesProcedureTroubleshooting @@ -158,0 +159,35 @@ If you want Amazon ECS to propagate the tags from the task definition or the ser +## Troubleshooting + +Some users might encounter the following error when they migrate from the short ARN format to the long ARN format. + +`There was an error while migrating the ARN of service `service-name`. The specified account does not have serviceLongArnFormat or taskLongArnFormat account settings enabled. Add account settings in order to enable tagging.` + +If you have already enabled the `serviceLongArnFormat` account setting but still encounter this error, it might be because the account settings for the long ARN format hasn't been enabled for the specific IAM principal that originally created the service. + + 1. Identify the principal that created the service. + + 1. In the console, the information is available in the **Created by** field in the **Configuration and networking** tab on the Service details page in the Amazon ECS console. + + 2. For the AWS CLI, run the following command: + +Replace the `user-input` with your values. + + aws ecs describe-services --cluster cluster-name --services service-name --query 'services[0].{createdBy: createdBy}' + + 2. Enable the required account settings for that specific principal. You can do this in one of the following ways: + + 1. Assume the IAM user or role for that principal. Then run `put-account-setting`. + + 2. Use the root user to run the command while specifying the creating principal with the `principal-arn`. + +Example. + +Replace the `principal-arn` with the value from Step 1. + + aws ecs put-account-setting --name serviceLongArnFormat --value enabled --principal-arn arn:aws:iam::123456789012:role/jdoe + + + + +Both methods enable the required `serviceLongArnFormat` account setting on the principal that created the service, which allows the ARN migration to proceed. +