Go 言語と awscli を使って ECS/Fargate 上でコマンド実行してみた

resource "aws_ecs_task_definition" "sample" {
  family                   = "sample"
  cpu                      = "256"
  memory                   = "512"
  network_mode             = "awsvpc"
  requires_compatibilities = ["FARGATE"]
  execution_role_arn       = module.ecs_task_execution_role.iam_role_arn
  task_role_arn            = module.ecs_task__role.iam_role_arn
  container_definitions    = data.template_file.container_definition_sample.rendered
}

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "",
      "Effect": "Allow",
      "Principal": {
        "Service": "ecs-tasks.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

  statement {
    effect = "Allow"
    actions = [
      "ssmmessages:CreateControlChannel",
      "ssmmessages:CreateDataChannel",
      "ssmmessages:OpenControlChannel",
      "ssmmessages:OpenDataChannel"
    ]
    resources = ["*"]
  }

$ aws ecs update-service \
    --cluster <ClusterArn> \
    --service <ServiceName> \
    --task <TaskName> \
    --enable-execute-command #<--- 有効化

$ aws ecs run-task --cluster <ClusterArn> \
    --task-definition <TaskDefinition:Revision> \
    --network-configuration "awsvpcConfiguration={subnets=["Subnet_ID1", "Subnet_ID2"],securityGroups=["SecurityGroupId"],assignPublicIp=DISABLED}" \
    --launch-type FARGATE --enable-execute-command

aws ecs execute-command --cluster <ClusterArn> \
    --task <TaskId> --container <ContainerName> \
    --interactive --command "ps ax"

The Session Manager plugin was installed successfully. Use the AWS CLI to start a session.

Starting session with SessionId: ecs-execute-command-0b2c79e1e775f274c
PID   USER     TIME   COMMAND
    1 root       0:00 /bin/sh -c nginx -g "daemon off;"
    7 root       0:00 nginx: master process nginx -g daemon off;
    8 nginx      0:00 nginx: worker process
    9 nginx      0:00 nginx: worker process
   10 root       0:00 /managed-agents/execute-command/amazon-ssm-agent
   23 root       0:00 /managed-agents/execute-command/ssm-agent-worker
   72 root       0:00 /managed-agents/execute-command/ssm-session-worker ecs-ex
   80 root       0:00 ps ax


Exiting session with sessionId: ecs-execute-command-0b2c79e1e775f274c.

package main

import (
	"fmt"

	"github.com/aws/aws-sdk-go/aws"
	"github.com/aws/aws-sdk-go/aws/awserr"
	"github.com/aws/aws-sdk-go/aws/session"
	"github.com/aws/aws-sdk-go/service/ecs"
)

func main() {
	svc := ecs.New(session.New(aws.NewConfig().WithRegion("ap-northeast-1")))

	input := &ecs.ExecuteCommandInput{
		Cluster:     aws.String("<ClusterName>"),
		Command:     aws.String("ps aux"),
		Container:   aws.String("<ContainerName>"),
		Interactive: aws.Bool(true),
		Task:        aws.String("<TaskId>"),
	}

	result, err := svc.ExecuteCommand(input)
	if err != nil {
		if aerr, ok := err.(awserr.Error); ok {
			fmt.Println(aerr.Error())
		}
		fmt.Println(err.Error())

		return
	}

	fmt.Println(result)
}

{
   "clusterArn": "string",
   "containerArn": "string",
   "containerName": "string",
   "interactive": boolean,
   "session": {
      "sessionId": "string",
      "streamUrl": "string",
      "tokenValue": "string"
   },
   "taskArn": "string":
}

{
    "containerOverrides": [
        {
           "name": "<ContainerName>",
            "command": [
                "<Command>"
            ]
        }
    ]
}

aws ecs run-task --cluster <ClusterArn> \
    --task-definition <TaskDefinition:Revision> \
    --network-configuration "awsvpcConfiguration={subnets=["<SubnetId1>", "<SubnetId2>"],securityGroups=["SecurityGroupId"],assignPublicIp=DISABLED}" \
    --launch-type FARGATE \
    --overrides file://<作成した json ファイル>.json

package main

import (
	"fmt"

	"github.com/aws/aws-sdk-go/aws"
	"github.com/aws/aws-sdk-go/aws/awserr"
	"github.com/aws/aws-sdk-go/aws/session"
	"github.com/aws/aws-sdk-go/service/ecs"
)

func main() {
	// svc := ecs.New(session.New(aws.NewConfig().WithRegion("ap-northeast-1")))
	sess := session.Must(session.NewSessionWithOptions(session.Options{
		Config: aws.Config{
			CredentialsChainVerboseErrors: aws.Bool(true),
		},
	}))
	svc := ecs.New(sess)

	input := &ecs.RunTaskInput{
		Cluster:        aws.String("<ClusterArn>),
		TaskDefinition: aws.String("<TaskDefinition:Revision>),
		Overrides: &ecs.TaskOverride{
			ContainerOverrides: []*ecs.ContainerOverride{
				{
					Name:    aws.String("<ContainerName>"),
					Command: aws.StringSlice([]string{"<実行したいコマンドを記す>"}),
				},
			},
		},
		NetworkConfiguration: &ecs.NetworkConfiguration{
			AwsvpcConfiguration: &ecs.AwsVpcConfiguration{
				Subnets:        aws.StringSlice([]string{"<SubnetId1>", "<SubnetId2>"}), // サブネットID
				AssignPublicIp: aws.String("DISABLED"),                                                            // 必要に応じて
			},
		},
		LaunchType: aws.String("FARGATE"),
	}

	result, err := svc.RunTask(input)
	if err != nil {
		if aerr, ok := err.(awserr.Error); ok {
			switch aerr.Code() {
			case ecs.ErrCodeServerException:
				fmt.Println(ecs.ErrCodeServerException, aerr.Error())
			case ecs.ErrCodeClientException:
				fmt.Println(ecs.ErrCodeClientException, aerr.Error())
			case ecs.ErrCodeInvalidParameterException:
				fmt.Println(ecs.ErrCodeInvalidParameterException, aerr.Error())
			case ecs.ErrCodeClusterNotFoundException:
				fmt.Println(ecs.ErrCodeClusterNotFoundException, aerr.Error())
			case ecs.ErrCodeUnsupportedFeatureException:
				fmt.Println(ecs.ErrCodeUnsupportedFeatureException, aerr.Error())
			case ecs.ErrCodePlatformUnknownException:
				fmt.Println(ecs.ErrCodePlatformUnknownException, aerr.Error())
			case ecs.ErrCodePlatformTaskDefinitionIncompatibilityException:
				fmt.Println(ecs.ErrCodePlatformTaskDefinitionIncompatibilityException, aerr.Error())
			case ecs.ErrCodeAccessDeniedException:
				fmt.Println(ecs.ErrCodeAccessDeniedException, aerr.Error())
			case ecs.ErrCodeBlockedException:
				fmt.Println(ecs.ErrCodeBlockedException, aerr.Error())
			default:
				fmt.Println(aerr.Error())
			}
		} else {
			fmt.Println(err.Error())
		}
		return
	}

	fmt.Println(result)
}