Answers: <p>Check if you can use AWS Session Manager to connect to the instance. I was having the same issue and I found it was because the SSM agent on the instance could not connect due to having restricted egress network access.</p>
  
Answers: CC BY-SA 4.0
Answers: 2023-02-17T15:17:48.373Z
Answers: 2023-02-17T15:17:48.373Z
Answers: Lawrence Aiello
Body: <p>I'm attempting to login to a container (from ECR) deployed into an AWS ECS cluster. For what it's worth I'm using the docker compose/ecs integration to deploy this cluster. My docker compose file is very minimal. The container needs a GPU so I'm deploying it to a GPU instance (g4dn.12xlarge) with an ecs optimized ami, ami-03d0d75de9d82f509 (amzn2-ami-ecs-gpu-hvm-2.0.20221230-x86_64-ebs).</p>
  <p>I'm trying to exec into this container but am unable to login.</p>
  <p>I've executed this command to attempt login:</p>
  <pre><code>aws ecs execute-command --cluster apptest --task 36fd9d835ad24b4ca188e40c59768cee --container apptest --interactive --command &quot;/bin/sh&quot;
  </code></pre>
  <p>I'm getting the following error:</p>
  <pre><code>The Session Manager plugin was installed successfully. Use the AWS CLI to start a session.
  
  
  An error occurred (TargetNotConnectedException) when calling the ExecuteCommand operation: The execute command failed due to an internal error. Try again later.
  
  </code></pre>
  <p>I would really appreciate any additional info on why I might be getting this error and what I should check/test.</p>
  <p>I've run the amazon-ecs-exec-checker script which gives the following output (I have removed some account info). Exec is enabled for the task and I believe all the correct permissions are in place (SSM policy permissions, etc). When I searched for similiar errors on google I saw that this was an issue on older ami's but it should have been fixed.</p>
  <pre><code>    Prerequisites for check-ecs-exec.sh v0.7
  -------------------------------------------------------------
    jq      | OK (/usr/bin/jq)
    AWS CLI | OK (/usr/local/bin/aws)
  
  -------------------------------------------------------------
  Prerequisites for the AWS CLI to use ECS Exec
  -------------------------------------------------------------
    AWS CLI Version        | OK (aws-cli/2.9.9 Python/3.9.11 Linux/5.10.149-133.644.amzn2.x86_64 exe/x86_64.amzn.2 prompt/off)
    Session Manager Plugin | OK (1.2.398.0)
  
  -------------------------------------------------------------
  Checks on ECS task and other resources
  -------------------------------------------------------------
  Region : us-east-1
  Cluster: apptest
  Task   : arn:aws:ecs:us-east-1:****:task/apptest/36fd9d835ad24b4ca188e40c59768cee
  -------------------------------------------------------------
    Cluster Configuration  | Audit Logging Not Configured
    Can I ExecuteCommand?  | arn:aws:iam::****:user/***
       ecs:ExecuteCommand: allowed
       ssm:StartSession denied?: allowed
    Task Status            | RUNNING
    Launch Type            | EC2
    ECS Agent Version      | 1.67.2
    Exec Enabled for Task  | OK
    Container-Level Checks |
      ----------
        Managed Agent Status
      ----------
           1. STOPPED (Reason: Received Container Stopped event) for &quot;apptest_ResolvConf_InitContainer&quot; - LastStartedAt: null
           2. RUNNING for &quot;apptest&quot;
      ----------
        Init Process Enabled (apptest-apptest:14)
      ----------
           1. Disabled - &quot;apptest_ResolvConf_InitContainer&quot;
           2. Disabled - &quot;apptest&quot;
      ----------
        Read-Only Root Filesystem (apptest-apptest:14)
      ----------
           1. Disabled - &quot;apptest_ResolvConf_InitContainer&quot;
           2. Disabled - &quot;apptest&quot;
    Task Role Permissions  | arn:aws:iam::****:role/apptest-apptestTaskRole-12KZYNKIW0B65
       ssmmessages:CreateControlChannel: allowed
       ssmmessages:CreateDataChannel: allowed
       ssmmessages:OpenControlChannel: allowed
       ssmmessages:OpenDataChannel: allowed
    VPC Endpoints          | SKIPPED (vpc-020109*** - No additional VPC endpoints required)
    Environment Variables  | (apptest-apptest:14)
         1. container &quot;apptest_ResolvConf_InitContainer&quot;
         - AWS_ACCESS_KEY: not defined
         - AWS_ACCESS_KEY_ID: not defined
         - AWS_SECRET_ACCESS_KEY: not defined
         2. container &quot;apptest&quot;
         - AWS_ACCESS_KEY: not defined
         - AWS_ACCESS_KEY_ID: not defined
         - AWS_SECRET_ACCESS_KEY: not defined
  
  </code></pre>
  
Tags: <docker><amazon-web-services><amazon-ecs><ecs>
Title: I cannot exec into a docker container running in ECS
UserDisplayName: mwill4321
ThreadText: # I cannot exec into a docker container running in ECS
  
  (Asked by: username_0 on 2023-01-03)
  
  I'm attempting to login to a container (from ECR) deployed into an AWS ECS cluster. For what it's worth I'm using the docker compose/ecs integration to deploy this cluster. My docker compose file is very minimal. The container needs a GPU so I'm deploying it to a GPU instance (g4dn.12xlarge) with an ecs optimized ami, ami-03d0d75de9d82f509 (amzn2-ami-ecs-gpu-hvm-2.0.20221230-x86\_64-ebs).
  
  I'm trying to exec into this container but am unable to login.
  
  I've executed this command to attempt login:
  
  ```
  aws ecs execute-command --cluster apptest --task 36fd9d835ad24b4ca188e40c59768cee --container apptest --interactive --command "/bin/sh"
  
  ```
  
  I'm getting the following error:
  
  ```
  The Session Manager plugin was installed successfully. Use the AWS CLI to start a session.
  
  An error occurred (TargetNotConnectedException) when calling the ExecuteCommand operation: The execute command failed due to an internal error. Try again later.
  
  ```
  
  I would really appreciate any additional info on why I might be getting this error and what I should check/test.
  
  I've run the amazon-ecs-exec-checker script which gives the following output (I have removed some account info). Exec is enabled for the task and I believe all the correct permissions are in place (SSM policy permissions, etc). When I searched for similiar errors on google I saw that this was an issue on older ami's but it should have been fixed.
  
  ```
      Prerequisites for check-ecs-exec.sh v0.7
  -------------------------------------------------------------
    jq      | OK (/usr/bin/jq)
    AWS CLI | OK (/usr/local/bin/aws)
  
  -------------------------------------------------------------
  Prerequisites for the AWS CLI to use ECS Exec
  -------------------------------------------------------------
    AWS CLI Version        | OK (aws-cli/2.9.9 Python/3.9.11 Linux/5.10.149-133.644.amzn2.x86_64 exe/x86_64.amzn.2 prompt/off)
    Session Manager Plugin | OK (1.2.398.0)
  
  -------------------------------------------------------------
  Checks on ECS task and other resources
  -------------------------------------------------------------
  Region : us-east-1
  Cluster: apptest
  Task   : arn:aws:ecs:us-east-1:****:task/apptest/36fd9d835ad24b4ca188e40c59768cee
  -------------------------------------------------------------
    Cluster Configuration  | Audit Logging Not Configured
    Can I ExecuteCommand?  | arn:aws:iam::****:user/***
       ecs:ExecuteCommand: allowed
       ssm:StartSession denied?: allowed
    Task Status            | RUNNING
    Launch Type            | EC2
    ECS Agent Version      | 1.67.2
    Exec Enabled for Task  | OK
    Container-Level Checks |
      ----------
        Managed Agent Status
      ----------
           1. STOPPED (Reason: Received Container Stopped event) for "apptest_ResolvConf_InitContainer" - LastStartedAt: null
           2. RUNNING for "apptest"
      ----------
        Init Process Enabled (apptest-apptest:14)
      ----------
           1. Disabled - "apptest_ResolvConf_InitContainer"
           2. Disabled - "apptest"
      ----------
        Read-Only Root Filesystem (apptest-apptest:14)
      ----------
           1. Disabled - "apptest_ResolvConf_InitContainer"
           2. Disabled - "apptest"
    Task Role Permissions  | arn:aws:iam::****:role/apptest-apptestTaskRole-12KZYNKIW0B65
       ssmmessages:CreateControlChannel: allowed
       ssmmessages:CreateDataChannel: allowed
       ssmmessages:OpenControlChannel: allowed
       ssmmessages:OpenDataChannel: allowed
    VPC Endpoints          | SKIPPED (vpc-020109*** - No additional VPC endpoints required)
    Environment Variables  | (apptest-apptest:14)
         1. container "apptest_ResolvConf_InitContainer"
         - AWS_ACCESS_KEY: not defined
         - AWS_ACCESS_KEY_ID: not defined
         - AWS_SECRET_ACCESS_KEY: not defined
         2. container "apptest"
         - AWS_ACCESS_KEY: not defined
         - AWS_ACCESS_KEY_ID: not defined
         - AWS_SECRET_ACCESS_KEY: not defined
  
  ```
  
  **Tags:** docker, amazon-web-services, amazon-ecs, ecs
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2023-02-17. Score: 1
  
  Check if you can use AWS Session Manager to connect to the instance. I was having the same issue and I found it was because the SSM agent on the instance could not connect due to having restricted egress network access.
  
  
  ---
  
  