Page MenuHomeElementl

Give dagit permission to interact with ECS

Authored by jordansanders on Jul 20 2021, 9:46 PM.
Referenced Files
Unknown Object (File)
Wed, May 10, 12:41 PM
Unknown Object (File)
Wed, May 10, 10:36 AM
Unknown Object (File)
May 1 2023, 1:35 PM
Unknown Object (File)
Apr 30 2023, 11:17 AM
Unknown Object (File)
Apr 27 2023, 9:49 AM
Unknown Object (File)
Mar 25 2023, 5:37 PM
Unknown Object (File)
Mar 24 2023, 3:55 AM
Unknown Object (File)
Mar 21 2023, 7:16 PM



Two different users encountered suspiciously similar issues with
ECS depoyments today:


I was able to reproduce the issue by launching a run and then
immediately switching to view in progress runs. I started seeing GraphQL
failures indicating NoCredentialsError. I suspect this is because in our
reference ECS deployment, dagit indeed doesn't have the ability to
interact with the ECS SDK.

This adds a TaskRole to dagit with the same widely-scoped access as the
one we attach to the daemon task. We should more narrowly scope both but
I'll leave that task to another day.

Test Plan

I tested this by redeploying using the updated docker-compose.yml and
verifying that:

a) the TaskRole is attached
b) I can't reproduce the error

Diff Detail

R1 dagster
Lint Not Applicable
Tests Not Applicable

Event Timeline

in addition to this, do we want to make any python changes so that the error message in is less cryptic? a descriptive exception from can_terminate seems better than "list index out of range"

This revision is now accepted and ready to land.Jul 21 2021, 7:34 PM