AWS AmazonECS documentation change
Summary
Added new section for agent disconnect troubleshooting including IAM/SG checks, service restarts, and deregistration commands
Security assessment
Includes security-adjacent troubleshooting steps (IAM role verification, security group checks) but does not fix vulnerabilities - documents security-related operational practices
Diff
diff --git a/AmazonECS/latest/developerguide/troubleshooting-managed-instances-complete.md b/AmazonECS/latest/developerguide/troubleshooting-managed-instances-complete.md index 0bc299b4b..107d0776e 100644 --- a//AmazonECS/latest/developerguide/troubleshooting-managed-instances-complete.md +++ b//AmazonECS/latest/developerguide/troubleshooting-managed-instances-complete.md @@ -15 +15 @@ Before troubleshooting Amazon ECS Managed Instances, ensure that you have the fo - * The AWS CLI installed and configured with appropriate permissions + * The AWS CLI is installed and configured with appropriate permissions @@ -32 +32 @@ You can view these Amazon ECS log files in Amazon ECS Managed Instances by conne -**Deploy Debug Container with privileges and Linux capabilities as Amazon ECS task:** +**Deploy a debug container with privileges and Linux capabilities as an Amazon ECS task:** @@ -70,3 +69,0 @@ Create a task definition using a CLI JSON file called `node-debugger.json`. - "capabilities": { - "add": ["NET_ADMIN", "SYS_ADMIN", "BPF"] - }, @@ -129 +126 @@ Connect to the container. Run the following command. -**Check Amazon ECS Agent Logs:** +**Check the Amazon ECS agent logs:** @@ -150 +147 @@ In the interactive session of the container, run the following commands: -**Check Agent Metrics:** +**Check agent metrics:** @@ -196 +193 @@ Run the following commands to diagnose task placement issues and gather informat -**System Service Monitoring:** +**System service monitoring:** @@ -233 +230 @@ The following are synptoms of networking issues: -**Network Connectivity Tests:** +**Network connectivity tests:** @@ -268 +265 @@ Run commands to monitory the resources and container limits. -**Resource Monitoring:** +**Resource monitoring:** @@ -285,0 +283,55 @@ Run commands to monitory the resources and container limits. +### Container instance agent disconnect issue + +The following are symptoms of container instance agent disconnect issues: + + * Container instances showing as disconnected in the Amazon ECS console + + * Tasks failing to be placed on specific instances + + * Agent registration failures in logs + + + + +#### Diagnostic steps + +If there is an existing privilege task running on the host that ECS Exec can access, run the following commands to diagnose agent connectivity issues: + + + # check service status + nsenter -t 1 -m -p systemctl restart ecs + nsenter -t 1 -m -p systemctl restart containerd + + # restart stopped services + nsenter -t 1 -m -p systemctl restart ecs + nsenter -t 1 -m -p systemctl restart containerd + +Otherwise, force deregister the Amazon ECS Managed Instances. Run the following command: + + + # list ECS Managed Instance container + aws ecs list-container-instances --cluster managed-instances-cluster --query 'containerInstanceArns' --output text + + # deregister the specific container instance + aws ecs deregister-container-instance \ + --cluster $ECS_CLUSTER_NAME \ + --container-instance container-instance-arn \ + --force + +#### Resolution + +To resolve agent disconnect issues, follow these steps: + + * Verify IAM role permissions for the container instance + + * Check security group rules allow outbound HTTPS traffic to ECS endpoints + + * Ensure network connectivity to AWS services + + * Restart the ECS agent service if necessary: `nsenter -t 1 -m -p systemctl restart ecs` + + * Verify the ECS_CLUSTER configuration in /etc/ecs/ecs.config matches your cluster name + + + +