Artillery with AWS Fargate IAM Role & Policy

[samhunter1]

Hi all,

The Fargate section of the Artillery docs mentions this:

"(Optional) An IAM role named artilleryio-ecs-worker-role for Fargate tasks that execute the test. If a role with that name already exists, Artillery will use it instead of creating it."

When trying to execute my Artillery tests via Fargate I get this error:

EntityAlreadyExists: Role with name artilleryio-ecs-worker-role already exists. Code: EntityAlreadyExists

This contradicts the documentation and when I delete the artilleryio-ecs-worker role it trips up on a policy as well:

EntityAlreadyExists: A policy called artilleryio-ecs-worker-policy already exists. Duplicate names are not allowed. Code: EntityAlreadyExists

Just wondering if this is a known bug or if there is anyway for Artillery to use the role and policy on AWS.

Thanks and I appreciate any help.

[hassy]

The relevant code is here: https://github.com/artilleryio/artillery/blob/main/packages/artillery/lib/platform/aws-ecs/ecs.js#L126-L131

The code tries to look up the role by name to see if it exists, and only continues to try to create a new role if the lookup fails.

Can you try rerunning the Artillery command with DEBUG=platform:aws-ecs to see why exactly that look up is failing.

[samhunter1]

Hi thanks for the debug tip - turns out I didn't have permissions to get roles so it was denied trying to find the role/policy - creating a new one then erroring as you can't have duplicate names. We added a iam:GetRole action to the Test Policy which is then linked to my account. Ended up with this:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "iam:ListPolicies",
                "iam:ListUsers",
                "iam:AttachRolePolicy",
                "iam:GetRole",
                "iam:CreateRole",
                "iam:CreatePolicy",
                "iam:CreateServiceLinkedRole"
            ],
            "Resource": "*"
        },
        {
            "Sid": "VisualEditor1",
            "Effect": "Allow",
            "Action": "*",
            "Resource": "*",
            "Condition": {
                "StringEquals": {
                    "aws:RequestedRegion": "us-east-2"
                }
            }
        }
    ]
}

Thanks for the help!