I have an ECS Service to which I want to attach two load balancers, and one of those load balancers is in a different region of the ECS Cluster. When I try to apply changes I get the following error.
InvalidParameterException: Unable to assume role and validate the specified targetGroupArn. Please verify that the ECS service role being passed has the proper permissions.
Here is terraform code I'm using and the output of the terraform plan:
resource "aws_ecs_service" "monitoring_grafana_service" {
name = "grafana"
cluster = module.ecs.ecs_cluster_arn
task_definition = aws_ecs_task_definition.monitoring_grafana_task.arn
desired_count = 1
network_configuration{
subnets = module.monitoring_vpc.private_subnets
security_groups = [ module.grafana_sg.security_group_id ]
}
load_balancer {
target_group_arn = module.frontend_alb.target_group_arns[0]
container_name = "grafana"
container_port = 3000
}
load_balancer {
target_group_arn = data.terraform_remote_state.ireland_vpc.outputs.oss_target_group_arns[0]
container_name = "grafana"
container_port = 3000
}
lifecycle {
ignore_changes = [
capacity_provider_strategy
]
}
}
Output:
+ load_balancer {
+ container_name = "grafana"
+ container_port = 3000
+ target_group_arn = "arn:aws:elasticloadbalancing:eu-central-1:myAcc:targetgroup/grafna20220202125410761200000016/1cdafdd8e73c1d9a"
}
+ load_balancer {
+ container_name = "grafana"
+ container_port = 3000
+ target_group_arn = "arn:aws:elasticloadbalancing:eu-west-1:myAcc:targetgroup/grafna20220203130531009700000004/ff91959dcf50287e"
}
The Service Role used by ECS is the "default" one, created by AWS. It has the AWS managed policy: AmazonECSServiceRolePolicy