hashicorp / hashicorp/consul

Failed to get ECS Tasks: List Tasks failed: operation error ECS: ListTasks, https response error StatusCode: 403 - Consul 1.21.5

Open
#23,095 2 comments 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
30.1k
Forks
4.6k
Avg merge
1d 18h
Merged PRs (30d)
39

Description

#### Overview of the Issue

Hi Team,

I am getting Failed to get ECS Tasks: List Tasks failed: operation error ECS: ListTasks, https response error StatusCode: 403 after updating consul from 1.21.4 to 1.21.5 version

Note : we are running the Consul on AWS Fargate ECS cluster.

Full error


2025-12-04T10:52:49.442Z [ERROR] agent: Cannot discover address: cluster=LAN address="provider=aws region=Region_here tag_key=consul_id tag_value=tag_here service=ecs ecs_cluster=Cluster_name" error="discover-aws: Failed to get ECS Tasks: ListTasks failed: operation error ECS: ListTasks, https response error StatusCode: 403, RequestID: , deserialization failed, failed to decode response body, invalid character '<' looking for beginning of value" |  
-- | --
  |  

We already have the Listcluster, ListTask and describeTask action in our ECS task policy.

Is there anything changed in ecs:listTask command to get the task?

I have to update the version from 1.21.4 to any newer version as this is throwing so many go related vulnerabilities. I have tried 1.21.5 , 1.22.0 and 1.22.1 all three version and it is failing for all of them with same error.

Please provide any suggestion.

#### Reproduction Steps

### Consul info for both Client and Server

Client info

```
Output from client 'consul info' command here
```

```
Client agent HCL config
```

Server info

```
Output from server 'consul info' command here
```

```
Server agent HCL config
```

### Operating system and Environment details

### Log Fragments

Contributor guide

Open the contributing guide

Research direction

No source files or tests are identified. Start by reproducing the AWS ECS discovery failure at the Consul agent's ECS ListTasks entry point, comparing Consul 1.21.4 with 1.21.5, 1.22.0, and 1.22.1 using the reported task policy. Done means the cause of the 403 is identified and ECS task discovery works or the failure is clearly documented with a regression test.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, go
Domain
backend, cloud
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.