aws / aws/containers-roadmap

[ecs] [request]: Updating the iam service role

Open
#2,575 0 comments 5 reactions 1 assignee Claimed by @vibhav-ag View on GitHub
ECS Proposed Work in Progress
Dominant language
Shell
Stars
5.4k
Forks
334
PR merge metrics
No merged PRs in 30d

Description

### Community Note

* Please vote on this issue by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original issue to help the community and maintainers prioritize this request
* Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
* If you are interested in working on this issue or have submitted a pull request, please leave a comment

**Tell us about your request**
I would like the option to update a service iam role using the UpdateService api.

**Which service(s) is this request for?**
ECS

**Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard?**
You are able to update a service to change the loadBalancers value from one target group to 2 target groups. When you move from 1 target groups to 2 target groups the IAM requirements for the service change. If you used a custom role, the role MUST be replaced with the default Service Linked Role (AWSServiceRoleForECS). When you update the service using the loadbalancers attribute, it automatically will also update the IAM role to used the service linked role regardless of the way the service was configured before.

Since the IAM role is automatically updated, it is VERY hard for 3rd party services to manage this feature. In my case with terraform:
- Update the loadbalancers from 1 target group -> 2 target groups
- Apply terraform makes the change and AWS ALSO updates the iam role from my custom role to the service linked role
- If I plan terraform again, it tries to recreate the service since the roles don't match. If I manually update the role, i still have to recreate the service

Recreating the service requires manually deleting the service in the console or you get errors about:
creating ECS Service (service-name): operation error ECS: CreateService, InvalidParameterException: Creation of service was not idempotent.

**Are you currently working around this issue?**
In order for this to work we must currently delete the service in the aws console and then apply the change with both the new alb target groups and the new iam role.

**Additional context**
Terraform plan after changing the additional target groups from 2 target groups -> 1. Shows that the service must be replaced because of the iam_role
```
# module.application.module.ecs_service.aws_ecs_service.this[0] must be replaced
+/- resource "aws_ecs_service" "this" {
~ iam_role = "arn:aws:iam:::role/aws-service-role/ecs.amazonaws.com/AWSServiceRoleForECS" -> "arn:aws:iam:::role/" # forces replacement
name = "my-service"
- load_balancer {
- container_name = "my-container" -> null
- container_port = 80 -> null
- target_group_arn = "arn:aws:elasticloadbalancing:::targetgroup//xxxxxxxxx" -> null
# (1 unchanged attribute hidden)
}

# (5 unchanged blocks hidden)
}
```
This is based on this module: https://registry.terraform.io/modules/terraform-aws-modules/ecs/aws/latest
But the underlying issue is really about the fact that the ecs api does not allow for updating the iam roles

**Attachments**
none

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.