"run-task" runs migration task successfully, but doesn't trigger service update

[tapanhalani]

When trying to run a migration task prior to ECS service update as mentioned here, the 1-off migration task exits successfully, but the subsequent service update is not triggered, eventually causing the job to fail after timeout of 20 minutes.

Here is the relevant config in workflow file

      - name: Fill in the new image ID in the Amazon ECS task definition
        id: task-def
        uses: aws-actions/amazon-ecs-render-task-definition@c804dfbdd57f713b6c079302a4c01db7017a36fc
        with:
          task-definition: ${{ env.API_ECS_TASK_DEFINITION }}
          container-name: ${{ env.API_CONTAINER_NAME }}
          image: ${{ needs.build_and_publish.outputs.image }}

      - name: Deploy Amazon ECS task definition
        uses: aws-actions/amazon-ecs-deploy-task-definition@v2
        with:
          task-definition: ${{ steps.task-def.outputs.task-definition }}
          service: ${{ env.API_ECS_SERVICE }}
          cluster: ${{ env.ECS_CLUSTER }}
          run-task: true
          run-task-container-overrides: "[{\"name\": \"api\", \"entryPoint\": [\"poetry\"], \"command\": [\"run\",\"alembic\",\"upgrade\",\"head\"]}]"
          run-task-subnets: "subnet-097af35893522ecdd,subnet-01423e2c836ce7ec1"
          run-task-security-groups: "sg-05532ecb180e03f00"
          wait-for-task-stopped: true
          wait-for-service-stability: true
          wait-for-minutes: 20

[ashwin-vaswani-ch]

Hey @tapanhalani I was able to solve this by omitting the service arg when running a one-off task with the run-task-* parameters. Hope that helps!

[sluceno]

@tapanhalani

In my case, the service was not being created because it was hanging waiting for the migrations to finish. The migrations were already finished, but the process was blocked there waiting them to finish.

After debugging, in my case it was an insufficient permissions problem.

In order to wait to the migrations to STOP it needs the ecs::DescribeTasks permissions. Once I added that permission the process can see migrations being finished and therefore deploys the service