tmobile / pacbot

PacBot (Policy as Code Bot)
https://tmobile.github.io/pacbot/
Apache License 2.0
1.29k stars 276 forks source link

Installer hangs on ECS tasks #496

Closed fearoffish closed 3 years ago

fearoffish commented 3 years ago

Summary

Following the wiki page for installing (using a role that has administrator privileges) when the checks get to ECS Task Definitions it times out on each one. Nothing in the log either.

Reproduce steps

Follow the wiki install and run sudo python3 manager.py install

Expected Results

I expect the installer to complete successfully.

Actual Results

Step 1: Checking if required tools are availables
    Tool: Maven, checking ................................................................ [Found]
    Tool: Git, checking .................................................................. [Found]
    Tool: MySQL client, checking ......................................................... [Found]
    Tool: Terraform, checking ............................................................ [Found]
    Tool: Nodejs, checking ............................................................... [Found]
    Tool: npm, checking .................................................................. [Found]
    Tool: Angular, checking .............................................................. [Found]
    Tool: Yarn, checking ................................................................. [Found]
    Tool: Docker, checking ............................................................... [Found]
    Required tools are available!!!

Step 2: Checking if required python packages are available
    Package: docker, Module: Client, checking ............................................ [Found]
    Module: boto3, checking .............................................................. [Found]
    Required python packages are available!!!

Step 3: Reading required inputs from user

    Select AWS authentication mechanism:

    1. Using access key and secret key

    2. Assuming an IAM role

    3. Using IAM role attached to the this instance

    Type 1 or 2 or 3 to continue to create services in AWS: 1
    Required inputs are available!!!

Step 4: Checking settings and inputs
    Checking VPC and CIDR Blocks ......................................................... [Valid]
    Checking VPC subnets ................................................................. [Valid]
    Checking user-attached policies ...................................................... [Not Present]
    Administrator access policy .......................................................... [Present]

Step 5: Checking resource existence
        Resource: Aws Iam Role, name: `pacbot_ro` ............................................ [Exists]
        Resource: Aws Iam Policy, name: `pacbot_ecs_task_exec` ............................... [Exists]
        Resource: Aws Iam Role, name: `pacbot_run_batch` ..................................... [Exists]
        Resource: Aws Iam Role, name: `pacbot_ecs_role` ...................................... [Exists]
        Resource: Aws Iam Instance Profile, name: `pacbot_ecs_role_profile` .................. [Exists]
        Resource: Aws Iam Role, name: `pacbot_lambda_basic_execution` ........................ [Exists]
        Resource: Aws Iam Policy, name: `pacbot_ro` .......................................... [Exists]
        Resource: Aws Iam Role, name: `pacbot` ............................................... [Exists]
        Resource: Aws Iam Policy, name: `pacbot_pacbot-autofix` .............................. [Exists]
        Resource: Aws Iam Policy, name: `pacbot` ............................................. [Exists]
        Resource: Aws Security Group, name: `pacbot` ......................................... [Exists]
        Resource: Aws Db Option Group, name: `pacbot-mysql` .................................. [Exists]
        Resource: Aws Db Parameter Group, name: `pacbot-mysql` ............................... [Exists]
        Resource: Aws Db Subnet Group, name: `pacbot-mysql` .................................. [Exists]
        Resource: Aws Db Instance, identifier: `pacbot-data` ................................. [Exists]
        Resource: Aws Cloudwatch Log Group, name: `pacbot/elasticsearch` ..................... [Exists]
        Resource: Aws Elasticsearch Domain, domain_name: `pacbot-data` ....................... [Exists]
        Resource: Aws Lb, name: `pacbot` ..................................................... [Exists]
        Resource: Aws Alb Target Group, name: `pacbot-admin` ................................. [Exists]
        Resource: Aws Alb Target Group, name: `pacbot-asset` ................................. [Exists]
        Resource: Aws Alb Target Group, name: `pacbot-auth` .................................. [Exists]
        Resource: Aws Alb Target Group, name: `pacbot-compliance` ............................ [Exists]
        Resource: Aws Alb Target Group, name: `pacbot-config` ................................ [Exists]
        Resource: Aws Alb Target Group, name: `pacbot-ngnix` ................................. [Exists]
        Resource: Aws Alb Target Group, name: `pacbot-notifications` ......................... [Exists]
        Resource: Aws Alb Target Group, name: `pacbot-statistics` ............................ [Exists]
        Resource: Aws Ecr Repository, name: `pacbot-microservices` ........................... [Exists]
        Resource: Aws Ecr Repository, name: `pacbot-webapp` .................................. [Exists]
        Resource: Aws Cloudwatch Log Group, name: `pacbot/apis` .............................. [Exists]
        Resource: Aws Cloudwatch Log Group, name: `pacbot/ui` ................................ [Exists]
        Checking resource existence for AdminEcsTaskDefinition [.   ]

My question is, how do I debug this further...I'm merely a beginner at Python but willing to try out whatever is necessary.

fearoffish commented 3 years ago

Hmm, on further debugging I get the same problem using the aws cli:

$ aws ecs list-task-definitions

This just hangs. So it's not a pacbot installer issue. I'll dig into this and update the ticket or close it.

fearoffish commented 3 years ago

For some obscure reason the dns lookup was returning a local network ip that didn't resolve, so I set up a hosts file entry pointing to a public ip for ecs.us-east-1.amazonaws.com and it's working now.

Closing.