Stefano Vozza comments

Results 260 comments of


                                            Stefano Vozza

At least one account is missing the Workload Discovery IAM Role. Visit the Accounts page to see what accounts are affected and verify that the AWS CloudFormation StackSets stack instance in these accounts deployed correctly.

That IAM role in the message is not referring to the OpenSearch service role, we don't do any checks in the UI for that and the CloudFormation stacks would not...

At least one account is missing the Workload Discovery IAM Role. Visit the Accounts page to see what accounts are affected and verify that the AWS CloudFormation StackSets stack instance in these accounts deployed correctly.

The image doesn't appear to have come through, you might have to add it through the GitHub WebUI.

At least one account is missing the Workload Discovery IAM Role. Visit the Accounts page to see what accounts are affected and verify that the AWS CloudFormation StackSets stack instance in these accounts deployed correctly.

Ah okay, so it looks like there's something going wrong with the discovery process and it can't tell if the IAM role is deployed or not. Can you do me...

At least one account is missing the Workload Discovery IAM Role. Visit the Accounts page to see what accounts are affected and verify that the AWS CloudFormation StackSets stack instance in these accounts deployed correctly.

Interesting. Can you follow these steps to see why the tasks are failing to launch: - Sign in to the [Amazon Elastic Container Service console](https://console.aws.amazon.com/ecs/home). - Select the cluster named...

At least one account is missing the Workload Discovery IAM Role. Visit the Accounts page to see what accounts are affected and verify that the AWS CloudFormation StackSets stack instance in these accounts deployed correctly.

I've only seen this error when the solution has been deployed to an existing VPC that does not allow requests to route to to ECR. Has the solution been deployed...

At least one account is missing the Workload Discovery IAM Role. Visit the Accounts page to see what accounts are affected and verify that the AWS CloudFormation StackSets stack instance in these accounts deployed correctly.

For the solution to work correctly the discovery process needs to be able to route to all these APIs as documented here: https://docs.aws.amazon.com/solutions/latest/workload-discovery-on-aws/aws-apis.html. I'm assuming you don't have a NAT...

At least one account is missing the Workload Discovery IAM Role. Visit the Accounts page to see what accounts are affected and verify that the AWS CloudFormation StackSets stack instance in these accounts deployed correctly.

You need public NAT Gateways if you don't want to use VPC endpoints for all the services in the document I linked too. All Amazon SDK calls go to the...

At least one account is missing the Workload Discovery IAM Role. Visit the Accounts page to see what accounts are affected and verify that the AWS CloudFormation StackSets stack instance in these accounts deployed correctly.

Can you spin up an EC2 instance in one of the private subnet of your VPC and make sure that you can route to the ECR API. That way you...

At least one account is missing the Workload Discovery IAM Role. Visit the Accounts page to see what accounts are affected and verify that the AWS CloudFormation StackSets stack instance in these accounts deployed correctly.

So you're still seeing this error in ECS: `ResourceInitializationError: unable to pull secrets or registry auth: The task cannot pull registry auth from Amazon ECR: There is a connection issue...

At least one account is missing the Workload Discovery IAM Role. Visit the Accounts page to see what accounts are affected and verify that the AWS CloudFormation StackSets stack instance in these accounts deployed correctly.

If it's a permission issue there should be errors in CloudTrail for some APIs. This is just a guess but maybe there's an SCP that disallows the `passRole` command here:...