Very first creation of an ECS cluster fails

[vladimirtiukhtin]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform CLI and Terraform AWS Provider Version

Terraform v0.13.4
+ provider registry.terraform.io/hashicorp/aws v3.8.0

Affected Resource(s)

• aws_ecs_cluster

Debug Output

Error: InvalidParameterException: Unable to assume the service linked role. Please verify that the ECS service linked role exists

Expected Behavior

Everything works from the first attempt

Actual Behavior

First attempt fails, further attempts pass

[bflad]

Hi @vladimirtiukhtin 👋 Thank you for raising this. The ECS CreateCluster API reference does denote the IAM Service Linked Role behavior:

When you call the CreateCluster API operation, Amazon ECS attempts to create the Amazon ECS service-linked role for your account so that required resources in other AWS services can be managed on your behalf. However, if the IAM user that makes the call does not have permissions to create the service-linked role, it is not created. For more information, see Using Service-Linked Roles for Amazon ECS in the Amazon Elastic Container Service Developer Guide.

To lessen the occurrence of this issue in AWS accounts that have not provisioned ECS resources, we would recommend provisioning an aws_iam_service_linked_role resource in your Terraform configuration wherever appropriate for account-level resources. e.g.

resource "aws_iam_service_linked_role" "ecs" {
  aws_service_name = "ecs.amazonaws.com"
}

This may not fully mitigate the issue if its in the same configuration as the ECS Cluster provisioning as the new IAM Service Linked Role may not have propagated in time due to IAM's eventual consistency, however many Terraform configurations should already be split up appropriately between account-level and application-level configurations to make this beneficial until the resource can potentially be updated to retry around the CreateCluster call for this specific error.

[bflad]

Submitted this PR which should fix the issue by retrying the CreateCluster call for this error: #15457

[bflad]

The API retries for this has been merged and will release with version 3.10.0 of the Terraform AWS Provider, likely tomorrow. 👍

[ghost]

This has been released in version 3.10.0 of the Terraform AWS provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template for triage. Thanks!

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thanks!