Answers: <p>This error <code>CannotPullContainerError</code> usually occurs when you have no access to the Internet from ECS and thus it doesn't able to pull an image from registry.</p>
  
  <p>Make sure you have networking configured in such a way to have an access to Internet <a href="https://stackoverflow.com/questions/48226547/aws-fargate-cannotpullcontainererror-500">https://stackoverflow.com/questions/48226547/aws-fargate-cannotpullcontainererror-500</a></p>
  
  <p>Manually you can confirm everything with such steps</p>
  
  <ol>
  <li>Find route table. Check whether it belongs
  to your VPC.</li>
  <li>Find proper NAT (you need NAT Gateway ID) (<strong>IMPORTANT</strong>: NAT should be launched in PUBLIC
  subnet)</li>
  <li><p>Create a route for that</p>
  
  <p>$ aws ec2 create-route --route-table-id "rtb-037148d7b5967a231" --destination-cidr-block "0.0.0.0/0" --nat-gateway-id "nat-0c137ae8a2b409088"</p></li>
  </ol>
  
  <p>You can also use internet gateway instead of NAT but the main idea is the same - to create connectivity from service to registry.
  If you have that in place and verified you can easily rewrite that to ansible tasks.</p>
  
  <p><strong>Update</strong>
  To start an ECS task you want to use <code>ecs_task</code> module <a href="https://docs.ansible.com/ansible/latest/modules/ecs_task_module.html" rel="nofollow noreferrer">https://docs.ansible.com/ansible/latest/modules/ecs_task_module.html</a></p>
  
  <p>To pull image from repository and start it you can use these tasks</p>
  
  <pre><code>- name: docker login
    shell: "$(aws ecr get-login --no-include-email --region {{ default_region }})"
    args:
      executable: "/bin/bash"
  
  - name: pull latest app image
    docker_image:
      name: "{{ ecr_repository }}/myapp:{{ image_tag }}"
      force: yes
  
  - name: run application with docker compose
    docker_service:  # module is called docker_service before Ansible 2.8
      project_name: "myapp"
      project_src: "{{ app_dir }}"  # path to a directory containing a docker-compose.yml
      pull: yes
      recreate: always  # run scheduler from a clean state
      remove_orphans: yes  # remove containers for services not defined in the compose file
      state: present  # specifying present is the same as running docker-compose up
      restarted: yes  # use with state present to restart all containers
    register: output
  </code></pre>
  
  <p>but in case of Fargate the above is not needed as everything is handled by task definition</p>
  
Answers: CC BY-SA 4.0
Answers: 2020-01-16T17:29:44.313Z
Answers: Yeah, I do want to use Fargate. Why do I have to create two separate subnets, a private and a public one? I'll have a look and see if I can solve it with the link you referenced.
Answers: Kyu96
Answers: CC BY-SA 4.0
Answers: 2020-01-17T09:47:53.907Z
Answers: That's a common practice and a more secure way. Obviously you can create everything in a public subnet and in Fargate configuration choose Auto assign public IP address. Here's nice explanation with diagrams to help you sort out the things https://aws.amazon.com/blogs/compute/task-networking-in-aws-fargate/
Answers: Most Wanted
Answers: CC BY-SA 4.0
Answers: 2020-01-17T18:45:59.987Z
Answers: Do you mind expanding your reply with an Ansible script to set up the networking components correctly, as these still confuse me. For this example, security is not a concern. I just try to have a minimal viable example that runs on ECS with Fargate and is reachable from the outside, all setup via Ansible.
Answers: Kyu96
Answers: CC BY-SA 4.0
Answers: 2020-01-13T19:37:15.340Z
Answers: 2020-01-14T10:20:00.960Z
Answers: 2020-01-14T10:20:00.960Z
Answers: Most Wanted
Answers: <p>ECR needs authentication and authorization before you can pull an image.</p>
  
  <p>In your ansible <a href="https://docs.ansible.com/ansible/latest/modules/ecs_taskdefinition_module.html#parameters" rel="nofollow noreferrer">ecs_taskdefinition</a>, please make sure you have parameter <code>task_role_arn</code> or <code>execution_role_arn</code> pointing to a role (i.e. you need to create a role <code>my-task-role1</code>).</p>
  
  <p>Attach the AWS managed policy <code>AmazonECSTaskExecutionRolePolicy</code> to the role (for Fargate tasks, the policy <code>AmazonEKSFargatePodExecutionRolePolicy</code> might be a better choice).</p>
  
  <p>This should provide you with the necessary permissions to download your image from ECR.</p>
  
  <hr>
  
  <p>Policy descriptions from AWS Console:</p>
  
  <ul>
  <li><code>AmazonECSTaskExecutionRolePolicy</code>
  
  <blockquote>
    <p>Provides access to other AWS service resources that are required to run Amazon ECS tasks</p>
  </blockquote></li>
  <li><code>AmazonEKSFargatePodExecutionRolePolicy</code>
  
  <blockquote>
    <p>Provides access to other AWS service resources that are required to run Amazon EKS pods on AWS Fargate</p>
  </blockquote></li>
  </ul>
  
  <hr>
  
  <p>Side-note: AWS Console creates <code>ecsTaskExecutionRole</code> automatically if you create a Task Definition there.</p>
  
  <p>Description from "<em>Create new Task Definition</em>" in AWS Console:</p>
  
  <blockquote>
    <p>This role is required by tasks to pull container images and publish container logs to Amazon CloudWatch on your behalf. If you do not have the ecsTaskExecutionRole already, we can create one for you.</p>
  </blockquote>
  
Answers: CC BY-SA 4.0
Answers: 2020-01-14T12:43:22.307Z
Answers: 2020-01-14T12:43:22.307Z
Answers: Flo
Body: <p>I am creating my infrastructure with Ansible. I create a VPC and an ECS cluster where I use Fargate to run my docker containers.
  When the tasks are started I am prompted that the task was not able to pull the Image from the ECR. 
  <code>STOPPED (CannotPullContainerError: Error response from daem)</code></p>
  
  <p>I know for a fact that the URI to the image and the IAM permissions are correct. Also I don't think the issue is in the AMI or docker image, because when I create the same scenario over the AWS UI, it works fine. </p>
  
  <p>Therefore, I assume my VPC is not configured correctly in a way that it can not connect to the ECR.</p>
  
  <p>This is how I create my VPC and Subnet:</p>
  
  <pre><code>- name: "2) Create VPC"
    ec2_vpc_net:
      name: "{{vpc_name}}"
      state: present
      cidr_block: 10.10.0.0/16
      region: "{{ region_name }}"
    register: vpc_net
  
  - name: "3) Create VPC Subnet"
    ec2_vpc_subnet:
      state: present
      map_public: yes
      vpc_id: "{{vpc_net.vpc.id}}"
      cidr: 10.10.0.0/24
      tags:
        name: "test-subnet"
    register: vpc_subnet
  </code></pre>
  
  <p>How can I ensure my VPC and subnet is configured correctly so that the docker daemon can connect and pull the image from the ECR repo?
  Am I missing an important attribute?</p>
  
Comments: CC BY-SA 4.0
Comments: 2020-01-09T01:48:40.937Z
Comments: If you check on ECR repository you see your image?
Comments: Vader
Comments: CC BY-SA 4.0
Comments: 2020-01-09T01:49:28.393Z
Comments: Yeah, the image is there and the URI is correct. @WeyderFerreira
Comments: Kyu96
Comments: CC BY-SA 4.0
Comments: 2020-01-09T01:54:16.577Z
Comments: Are you sure that you Ansible role/playbook has access on AWS ECR?
Comments: Vader
Comments: CC BY-SA 4.0
Comments: 2020-01-09T02:04:21.527Z
Comments: I am 99% confident that this is the case. When the same scenario is performed over the ECS-Web-UI (which automatically creates VPC's, Subnets, Sec-groups etc) and only the Cluster, TaskDef and Service are created over Ansible and the VPC/Subnets/Secgroups that were created over the Web-UI are referenced, it works. So my educated guess is, a difference in the VPC/Subnet/SecurityGroup Configuration causes issues. Maybe I need an IGW so that a connection to the ECR can be established? For reference here is my entire playbook: https://pastebin.com/tzNpqGHi  @WeyderFerreira
Comments: Kyu96
Comments: CC BY-SA 4.0
Comments: 2020-01-09T08:21:43.410Z
Comments: is it possible to login to SSH to system, manually login Docker to the ECR and manually pull the image?
Comments: Ta Mu
Comments: CC BY-SA 4.0
Comments: 2020-01-09T10:09:20.113Z
Comments: I don't think I can SSH into a fargate managed instance. @Peter
Comments: Kyu96
Comments: CC BY-SA 4.0
Comments: 2020-01-09T10:21:43.477Z
Comments: Do I need to add another network component like a internet gateway, a routing table or a vpc endpoint? I also noticed when I perform the process over the UI where everything works the way it should, two subnets are created, not just one. Please let me know if I need to provide additional information to help to solve the problem. @Peter
Comments: Kyu96
Comments: CC BY-SA 4.0
Comments: 2020-01-13T14:24:35.510Z
Comments: For internal network communication on AWS you don't need LB.
Comments: Vader
Comments: CC BY-SA 4.0
Comments: 2020-01-13T15:00:19.690Z
Comments: @WeyderFerreira What's LB?
Comments: Kyu96
Comments: CC BY-SA 4.0
Comments: 2020-01-13T23:29:39.547Z
Comments: @Kyu96 Load Balancer, in AWS be can ALB (Application Load B.), NLB (Network Load B.), ELB (Elastic Load B.).
Comments: Vader
Comments: CC BY-SA 4.0
Comments: 2020-01-14T18:00:58.900Z
Comments: Can you edit your question to include the code that creates the Fargate service and task definition?
Comments: ydaetskcoR
Comments: CC BY-SA 4.0
Comments: 2020-01-14T18:02:13.100Z
Comments: It would also be helpful if you included the full error message that you're seeing. You should be able to see this by describing the task with the AWS CLI within a shortish period (2 hours?) of it stopping.
Comments: ydaetskcoR
Tags: <ansible><amazon-ecs><aws-vpc><aws-ecr><fargate>
Title: Configure VPC for ECR access
UserDisplayName: Kyu96
ThreadText: # Configure VPC for ECR access
  
  (Asked by: username_0 on 2020-01-09)
  
  I am creating my infrastructure with Ansible. I create a VPC and an ECS cluster where I use Fargate to run my docker containers.
  When the tasks are started I am prompted that the task was not able to pull the Image from the ECR.
  `STOPPED (CannotPullContainerError: Error response from daem)`
  
  I know for a fact that the URI to the image and the IAM permissions are correct. Also I don't think the issue is in the AMI or docker image, because when I create the same scenario over the AWS UI, it works fine.
  
  Therefore, I assume my VPC is not configured correctly in a way that it can not connect to the ECR.
  
  This is how I create my VPC and Subnet:
  
  ```
  - name: "2) Create VPC"
    ec2_vpc_net:
      name: "{{vpc_name}}"
      state: present
      cidr_block: 10.10.0.0/16
      region: "{{ region_name }}"
    register: vpc_net
  
  - name: "3) Create VPC Subnet"
    ec2_vpc_subnet:
      state: present
      map_public: yes
      vpc_id: "{{vpc_net.vpc.id}}"
      cidr: 10.10.0.0/24
      tags:
        name: "test-subnet"
    register: vpc_subnet
  
  ```
  
  How can I ensure my VPC and subnet is configured correctly so that the docker daemon can connect and pull the image from the ECR repo?
  Am I missing an important attribute?
  
  **Tags:** ansible, amazon-ecs, aws-vpc, aws-ecr, fargate
  
  > **Comments:**
  > **username_1**: If you check on ECR repository you see your image?  
  > **username_0**: Yeah, the image is there and the URI is correct. @WeyderFerreira  
  > **username_1**: Are you sure that you Ansible role/playbook has access on AWS ECR?  
  > **username_0**: I am 99% confident that this is the case. When the same scenario is performed over the ECS-Web-UI (which automatically creates VPC's, Subnets, Sec-groups etc) and only the Cluster, TaskDef and Service are created over Ansible and the VPC/Subnets/Secgroups that were created over the Web-UI are referenced, it works. So my educated guess is, a difference in the VPC/Subnet/SecurityGroup Configuration causes issues. Maybe I need an IGW so that a connection to the ECR can be established? For reference here is my entire playbook: https://pastebin.com/tzNpqGHi  @WeyderFerreira  
  > **username_2**: is it possible to login to SSH to system, manually login Docker to the ECR and manually pull the image?  
  > **username_0**: I don't think I can SSH into a fargate managed instance. @Peter  
  > **username_0**: Do I need to add another network component like a internet gateway, a routing table or a vpc endpoint? I also noticed when I perform the process over the UI where everything works the way it should, two subnets are created, not just one. Please let me know if I need to provide additional information to help to solve the problem. @Peter  
  > **username_1**: For internal network communication on AWS you don't need LB.  
  > **username_0**: @WeyderFerreira What's LB?  
  > **username_1**: @username_0 Load Balancer, in AWS be can ALB (Application Load B.), NLB (Network Load B.), ELB (Elastic Load B.).  
  > **username_3**: Can you edit your question to include the code that creates the Fargate service and task definition?  
  > **username_3**: It would also be helpful if you included the full error message that you're seeing. You should be able to see this by describing the task with the AWS CLI within a shortish period (2 hours?) of it stopping.  
  
  ---
  
  ## 2 answers
  
  ### Answer by username_4 on 2020-01-13. Score: 4
  
  This error `CannotPullContainerError` usually occurs when you have no access to the Internet from ECS and thus it doesn't able to pull an image from registry.
  
  Make sure you have networking configured in such a way to have an access to Internet <https://stackoverflow.com/questions/48226547/aws-fargate-cannotpullcontainererror-500>
  
  Manually you can confirm everything with such steps
  
  1. Find route table. Check whether it belongs
     to your VPC.
  2. Find proper NAT (you need NAT Gateway ID) (**IMPORTANT**: NAT should be launched in PUBLIC
     subnet)
  3. Create a route for that
  
     $ aws ec2 create-route --route-table-id "rtb-037148d7b5967a231" --destination-cidr-block "0.0.0.0/0" --nat-gateway-id "nat-0c137ae8a2b409088"
  
  You can also use internet gateway instead of NAT but the main idea is the same - to create connectivity from service to registry.
  If you have that in place and verified you can easily rewrite that to ansible tasks.
  
  **Update**
  To start an ECS task you want to use `ecs_task` module <https://docs.ansible.com/ansible/latest/modules/ecs_task_module.html>
  
  To pull image from repository and start it you can use these tasks
  
  ```
  - name: docker login
    shell: "$(aws ecr get-login --no-include-email --region {{ default_region }})"
    args:
      executable: "/bin/bash"
  
  - name: pull latest app image
    docker_image:
      name: "{{ ecr_repository }}/myapp:{{ image_tag }}"
      force: yes
  
  - name: run application with docker compose
    docker_service:  # module is called docker_service before Ansible 2.8
      project_name: "myapp"
      project_src: "{{ app_dir }}"  # path to a directory containing a docker-compose.yml
      pull: yes
      recreate: always  # run scheduler from a clean state
      remove_orphans: yes  # remove containers for services not defined in the compose file
      state: present  # specifying present is the same as running docker-compose up
      restarted: yes  # use with state present to restart all containers
    register: output
  
  ```
  
  but in case of Fargate the above is not needed as everything is handled by task definition
  
  > **Comments:**
  > **username_0**: Yeah, I do want to use Fargate. Why do I have to create two separate subnets, a private and a public one? I'll have a look and see if I can solve it with the link you referenced.  
  > **username_4**: That's a common practice and a more secure way. Obviously you can create everything in a public subnet and in Fargate configuration choose Auto assign public IP address. Here's nice explanation with diagrams to help you sort out the things https://aws.amazon.com/blogs/compute/task-networking-in-aws-fargate/  
  > **username_0**: Do you mind expanding your reply with an Ansible script to set up the networking components correctly, as these still confuse me. For this example, security is not a concern. I just try to have a minimal viable example that runs on ECS with Fargate and is reachable from the outside, all setup via Ansible.  
  
  ---
  
  ### Answer by username_5 on 2020-01-14. Score: 1
  
  ECR needs authentication and authorization before you can pull an image.
  
  In your ansible [ecs\_taskdefinition](https://docs.ansible.com/ansible/latest/modules/ecs_taskdefinition_module.html#parameters), please make sure you have parameter `task_role_arn` or `execution_role_arn` pointing to a role (i.e. you need to create a role `my-task-role1`).
  
  Attach the AWS managed policy `AmazonECSTaskExecutionRolePolicy` to the role (for Fargate tasks, the policy `AmazonEKSFargatePodExecutionRolePolicy` might be a better choice).
  
  This should provide you with the necessary permissions to download your image from ECR.
  
  ---
  
  Policy descriptions from AWS Console:
  
  * `AmazonECSTaskExecutionRolePolicy`
    > Provides access to other AWS service resources that are required to run Amazon ECS tasks
  * `AmazonEKSFargatePodExecutionRolePolicy`
    > Provides access to other AWS service resources that are required to run Amazon EKS pods on AWS Fargate
  
  ---
  
  Side-note: AWS Console creates `ecsTaskExecutionRole` automatically if you create a Task Definition there.
  
  Description from "*Create new Task Definition*" in AWS Console:
  
  > This role is required by tasks to pull container images and publish container logs to Amazon CloudWatch on your behalf. If you do not have the ecsTaskExecutionRole already, we can create one for you.
  
  
  ---
  
  