{"id":1462,"date":"2021-04-26T18:15:49","date_gmt":"2021-04-26T09:15:49","guid":{"rendered":"https:\/\/p-corporate-blog-cms.mmmcorp.co.jp\/?p=1462"},"modified":"2021-04-27T10:37:53","modified_gmt":"2021-04-27T01:37:53","slug":"amazon-ecs-exec-with-fargate","status":"publish","type":"post","link":"https:\/\/p-corporate-blog-cms.mmmcorp.co.jp\/blog\/2021\/04\/26\/amazon-ecs-exec-with-fargate\/","title":{"rendered":"AWS Fargate\u3067Amazon ECS Exec\u3092\u6709\u52b9\u306b\u3059\u308b"},"content":{"rendered":"
\u6700\u8fd1\u30ad\u30fc\u30dc\u30fc\u30c9\u6cbc\u306b\u306f\u307e\u308a\u3064\u3064\u3042\u308a\u307e\u3059\u3002 \u672c\u984c\u304b\u3089\u9038\u308c\u3066\u3057\u307e\u3044\u307e\u3057\u305f\u3002\u672c\u30a8\u30f3\u30c8\u30ea\u30fc\u3067\u306f\u3001 Amazon ECS Exec\uff08\u4ee5\u4e0bECS Exec\uff09\u306f\u30b3\u30f3\u30c6\u30ca\u306b\u5bfe\u3057\u3066\u5bfe\u8a71\u578b\u306e\u30b7\u30a7\u30eb\u3001\u3042\u308b\u3044\u306f\u4e00\u3064\u306e\u30b3\u30de\u30f3\u30c9\u3092\u5b9f\u884c\u3067\u304d\u308b\u3088\u3046\u306b\u306a\u308b\u6a5f\u80fd\u3067\u3059\u3002<\/p>\n AWS Fargate\u3067\u306f\u7ba1\u7406\u3059\u308b\u30af\u30e9\u30b9\u30bf\u30fc\u30a4\u30f3\u30b9\u30bf\u30f3\u30b9\u304c\u4e0d\u8981\u306b\u306a\u308b\u30e1\u30ea\u30c3\u30c8\u304c\u3042\u308a\u307e\u3057\u305f\u304c\u3001\u30b3\u30f3\u30c6\u30ca\u3078\u306e\u30a2\u30af\u30bb\u30b9\u304c\u96e3\u3057\u304f\u306a\u308b\u3068\u3044\u3046\u30c8\u30ec\u30fc\u30c9\u30aa\u30d5\u304c\u3042\u308a\u307e\u3057\u305f\u3002ECS Exec\u3092\u5229\u7528\u3059\u308b\u3053\u3068\u306b\u3088\u308a\u30b3\u30f3\u30c6\u30ca\u3078\u306e\u30a2\u30af\u30bb\u30b9\u304c\u5bb9\u6613\u306b\u306a\u308a\u30c7\u30d0\u30c3\u30b0\u3092\u884c\u3044\u3084\u3059\u304f\u306a\u308a\u307e\u3059\u3002<\/p>\n \u305d\u308c\u3067\u306f\u3001AWS Fargate\u3067ECS Exec\u3092\u6709\u52b9\u5316\u3057\u3066\u307f\u307e\u3059\u3002 ECS Exec\u306f\u30b3\u30f3\u30c6\u30ca\u3068\u306e\u901a\u4fe1\u5185\u5bb9\u3092KMS\u3067\u6697\u53f7\u5316\u3057\u307e\u3059\u306e\u3067\u3001\u307e\u305a\u6700\u521d\u306bKMS\u306e\u30ad\u30fc\u3092\u4f5c\u6210\u3057\u307e\u3059\u3002<\/p>\n \u4ee5\u4e0b\u306e\u30b3\u30de\u30f3\u30c9\u3092\u5b9f\u884c\u3057\u3001 \u4ee5\u4e0b\u306e\u30b3\u30de\u30f3\u30c9\u3092\u5b9f\u884c\u3057\u3066\u3001ECS\u30af\u30e9\u30b9\u30bf\u30fc\u3067ECS Exec\u3092\u6709\u52b9\u5316\u3057\u307e\u3059\u3002<\/p>\n \u4ee5\u4e0b\u306e\u30b3\u30de\u30f3\u30c9\u3092\u5b9f\u884c\u3057\u3001ECS\u30b5\u30fc\u30d3\u30b9\u3067ECS Exec\u3092\u6709\u52b9\u5316\u3057\u307e\u3059\u3002<\/p>\n IAM\u30ed\u30fc\u30eb\u306bIAM\u30dd\u30ea\u30b7\u30fc\u306b\u4ed8\u4e0e\u3057\u307e\u3059\u3002 \u672c\u30a8\u30f3\u30c8\u30ea\u30fc\u3067\u306f\u3001\u4e0b\u8a18JSON\u3092\u30a4\u30f3\u30e9\u30a4\u30f3\u30dd\u30ea\u30b7\u30fc\u3068\u3057\u3066\u3001 ECS Exec\u304c\u6709\u52b9\u306b\u306a\u3063\u3066\u3044\u308b\u304b\u78ba\u8a8d\u3057\u307e\u3059\u3002 ECS Exec\u304c\u6709\u52b9\u3067\u3042\u308c\u3070\u3001\u4ee5\u4e0b\u306e\u30d1\u30e9\u30e1\u30fc\u30bf\u30fc\u304c\u8fd4\u3063\u3066\u304d\u307e\u3059\u3002<\/p>\n \u4ee5\u4e0a\u3067\u8a2d\u5b9a\u306f\u5b8c\u4e86\u3067\u3059\u3002\u65e9\u901f\u3001ECS Exec\u3092\u5b9f\u884c\u3057\u3001 \u30a2\u30af\u30bb\u30b9\u3067\u304d\u307e\u3057\u305f\uff01\uff01\uff01\uff01 <\/strong><\/p>\n ECS Exec\u304c\u767a\u8868\u3055\u308c\u308b\u307e\u3067\u306f\u3001AWS Fargate\u3078\u306e\u30b3\u30f3\u30c6\u30ca\u30a2\u30af\u30bb\u30b9\u306fSSH\u516c\u958b\u9375\u3092\u30d1\u30e9\u30e1\u30fc\u30bf\u30b9\u30c8\u30a2\u306b\u767b\u9332\u3059\u308b\u65b9\u6cd5\u3084\u3001Systems Manager\u3078\u306e\u30a2\u30af\u30c6\u30a3\u30d9\u30fc\u30b7\u30e7\u30f3\u767b\u9332\u306e\u65b9\u6cd5\u304c\u3042\u308a\u307e\u3057\u305f\u304c\u3001\u3069\u3061\u3089\u3082\u4f7f\u3044\u3084\u3059\u3044\u3068\u306f\u8a00\u3044\u96e3\u3044\u70b9\u304c\u3042\u308a\u307e\u3057\u305f\u3002ECS Exec\u306b\u3088\u308aAWS\u516c\u5f0f\u3067\u30b3\u30f3\u30c6\u30ca\u3078\u306e\u30a2\u30af\u30bb\u30b9\u304c\u30b5\u30dd\u30fc\u30c8\u3055\u308c\u3001AWS Fargate\u3078\u306e\u30b3\u30f3\u30c6\u30ca\u30a2\u30af\u30bb\u30b9\u304c\u5bb9\u6613\u306b\u306a\u308a\u4eca\u307e\u3067\u30c8\u30ec\u30fc\u30c9\u30aa\u30d5\u3067\u3042\u3063\u305f\u70b9\u304c\u89e3\u6d88\u3055\u308c\u307e\u3057\u305f\u3002<\/p>\n \u7279\u306bIaC\u306b\u3088\u308a\u958b\u767a\u74b0\u5883\u306e\u307fECS Exec\u3092\u6709\u52b9\u5316\u3057\u958b\u767a\u52b9\u7387\u3092\u5411\u4e0a\u3067\u304d\u308b\u3053\u3068\u306b\u671f\u5f85\u3057\u3066\u304a\u308a\u307e\u3059\u3002<\/p>\n \u4ee5\u4e0a\u3067\u3059\uff01<\/p>\n","protected":false},"excerpt":{"rendered":" \u6700\u8fd1\u30ad\u30fc\u30dc\u30fc\u30c9\u6cbc\u306b\u306f\u307e\u308a\u3064\u3064\u3042\u308a\u307e\u3059\u3002 \u3084\u3063\u3055\u3093 \u3067\u3054\u3056\u3044\u307e\u3059\u3002 Keychron\u304c\u304a\u6c17\u306b\u5165\u308a\u3067\u3057\u3066\u3001K3\u3092\u4f7f\u3063\u3066\u3044\u307e\u3059\u3002 K3\u306e\u30ad\u30fc\u30ad\u30e3\u30c3\u30d7\u3092PBT\u306b\u4ea4\u63db\u3059\u308b\u3053\u3068\u3067\u6e80\u8db3\u306e\u884c\u304f\u6253\u9375\u611f\u3092\u624b\u306b\u5165\u308c\u308b\u3053\u3068\u304c\u3067\u304d\u307e\u3057\u305f\u3002 \u3053\u308c\u304c\u6700\u5f8c\u306e\u30ad\u30fc\u30dc\u30fc\u30c9\u6cbc\u3060\u3068\u4fe1\u3058\u3066 …. \u672c\u984c\u304b\u3089\u9038\u308c\u3066\u3057\u307e\u3044\u307e\u3057\u305f\u3002\u672c\u30a8\u30f3\u30c8\u30ea\u30fc\u3067\u306f\u3001 AWS Fargate\u3067Amazon ECS Exec\u3092\u6709\u52b9\u5316\u3059\u308b\u65b9\u6cd5\u3092\u3054\u7d39\u4ecb\u3057\u307e\u3059\u3002 Am […]<\/p>\n","protected":false},"author":8,"featured_media":1464,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[13],"tags":[],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/p-corporate-blog-cms.mmmcorp.co.jp\/wp-json\/wp\/v2\/posts\/1462"}],"collection":[{"href":"https:\/\/p-corporate-blog-cms.mmmcorp.co.jp\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/p-corporate-blog-cms.mmmcorp.co.jp\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/p-corporate-blog-cms.mmmcorp.co.jp\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/p-corporate-blog-cms.mmmcorp.co.jp\/wp-json\/wp\/v2\/comments?post=1462"}],"version-history":[{"count":17,"href":"https:\/\/p-corporate-blog-cms.mmmcorp.co.jp\/wp-json\/wp\/v2\/posts\/1462\/revisions"}],"predecessor-version":[{"id":1480,"href":"https:\/\/p-corporate-blog-cms.mmmcorp.co.jp\/wp-json\/wp\/v2\/posts\/1462\/revisions\/1480"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/p-corporate-blog-cms.mmmcorp.co.jp\/wp-json\/wp\/v2\/media\/1464"}],"wp:attachment":[{"href":"https:\/\/p-corporate-blog-cms.mmmcorp.co.jp\/wp-json\/wp\/v2\/media?parent=1462"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/p-corporate-blog-cms.mmmcorp.co.jp\/wp-json\/wp\/v2\/categories?post=1462"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/p-corporate-blog-cms.mmmcorp.co.jp\/wp-json\/wp\/v2\/tags?post=1462"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}\u3084\u3063\u3055\u3093<\/code> \u3067\u3054\u3056\u3044\u307e\u3059\u3002
\nKeychron\u304c\u304a\u6c17\u306b\u5165\u308a\u3067\u3057\u3066\u3001K3\u3092\u4f7f\u3063\u3066\u3044\u307e\u3059\u3002
\nK3\u306e\u30ad\u30fc\u30ad\u30e3\u30c3\u30d7\u3092PBT\u306b\u4ea4\u63db\u3059\u308b\u3053\u3068\u3067\u6e80\u8db3\u306e\u884c\u304f\u6253\u9375\u611f\u3092\u624b\u306b\u5165\u308c\u308b\u3053\u3068\u304c\u3067\u304d\u307e\u3057\u305f\u3002<\/p>\n
\n\u3053\u308c\u304c\u6700\u5f8c\u306e\u30ad\u30fc\u30dc\u30fc\u30c9\u6cbc\u3060\u3068\u4fe1\u3058\u3066 ....<\/p>\n
\nAWS Fargate\u3067Amazon ECS Exec\u3092\u6709\u52b9\u5316\u3059\u308b\u65b9\u6cd5\u3092\u3054\u7d39\u4ecb\u3057\u307e\u3059\u3002<\/p>\nAmazon ECS Exec\u3068\u306f<\/h2>\n
Amazon ECS Exec\u306e\u826f\u3044\u3068\u3053\u308d<\/h3>\n
AWS Fargate\u3067ECS Exec\u3092\u6709\u52b9\u5316\u3059\u308b<\/h2>\n
\n\u4ee5\u4e0b\u3092\u524d\u63d0\u6761\u4ef6\u3068\u3057\u307e\u3059\u3002<\/p>\n\n
export AWS_REGION=\u3010AWS\u30ea\u30fc\u30b8\u30e7\u30f3\u540d\u3011\nexport ECS_EXEC_BUCKET_NAME=\u3010ECS Exec\u5b9f\u884c\u30ed\u30b0\u3092\u4fdd\u5b58\u3059\u308bS3\u30d0\u30b1\u30c3\u30c8\u3011<\/code><\/pre>\n<\/li>\n
\n
1. KMS\u306e\u30ad\u30fc\u3092\u4f5c\u6210\u3059\u308b<\/h3>\n
\n
KMS_KEY=$(aws kms create-key --region $AWS_REGION)<\/code><\/pre>\n
\n
KMS_KEY_ARN=$(echo $KMS_KEY | jq --raw-output .KeyMetadata.Arn)<\/code><\/pre>\n
\n
aws kms create-alias \\\n--alias-name alias\/ecs-exec-demo-kms-key \\\n--target-key-id $KMS_KEY_ARN --region $AWS_REGION<\/code><\/pre>\n
\n
echo "The KMS Key ARN is: "$KMS_KEY_ARN<\/code><\/pre>\n
2. ECS Exec\u306e\u5b9f\u884c\u30ed\u30b0\u3092\u4fdd\u5b58\u3059\u308bS3\u30d0\u30b1\u30c3\u30c8\u3092\u4f5c\u6210\u3059\u308b<\/h3>\n
\nECS Exec\u306e\u5b9f\u884c\u30ed\u30b0\u3092\u4fdd\u5b58\u3059\u308bS3\u30d0\u30b1\u30c3\u30c8\u3092\u4f5c\u6210\u3057\u3066\u304a\u304d\u307e\u3059<\/p>\naws s3api create-bucket \\\n--bucket $ECS_EXEC_BUCKET_NAME \\\n--region $AWS_REGION \\\n--create-bucket-configuration LocationConstraint=$AWS_REGION<\/code><\/pre>\n
3. ECS\u30af\u30e9\u30b9\u30bf\u30fc\u3092\u66f4\u65b0\u3057\u3066\u3001ECS Exec\u3092\u6709\u52b9\u5316\u3059\u308b<\/h3>\n
aws ecs update-cluster \\\n --cluster pure-nginx \\\n --region $AWS_REGION \\\n --configuration executeCommandConfiguration="{logging=OVERRIDE,\\\n kmsKeyId=$KMS_KEY_ARN,\\\n logConfiguration={cloudWatchLogGroupName="\/aws\/ecs\/pure-nginx",\\\n s3BucketName=$ECS_EXEC_BUCKET_NAME,\\\n s3KeyPrefix=exec-output}}"<\/code><\/pre>\n
4. ECS\u30b5\u30fc\u30d3\u30b9\u3092\u66f4\u65b0\u3057\u3066\u3001ECS Exec\u3092\u6709\u52b9\u5316\u3059\u308b<\/h3>\n
aws ecs update-service \\\n--cluster pure-nginx \\\n--service pure-nginx \\\n--enable-execute-command \\\n--region $AWS_REGION<\/code><\/pre>\n
5. IAM\u30ed\u30fc\u30eb\u306b\u30dd\u30ea\u30b7\u30fc\u3092\u4ed8\u4e0e\u3059\u308b<\/h3>\n
\nECS\u30bf\u30b9\u30af\u30ed\u30fc\u30eb\u3068ECS\u30bf\u30b9\u30af\u5b9f\u884c\u30ed\u30fc\u30eb\u4e21\u65b9\u304c\u5bfe\u8c61\u306b\u306a\u308a\u307e\u3059\u3002
\nIAM\u30dd\u30ea\u30b7\u30fc\u306b\u306f\u3001\u4ee5\u4e0b\u306e\u30ea\u30bd\u30fc\u30b9\u3078\u306e\u6a29\u9650\u3092\u8a18\u8ff0\u3057\u307e\u3059\u3002<\/p>\n\n
IAM\u30dd\u30ea\u30b7\u30fc\u306e\u4f8b<\/h4>\n
\nECS\u30bf\u30b9\u30af\u30ed\u30fc\u30eb\u3068ECS\u30bf\u30b9\u30af\u5b9f\u884c\u30ed\u30fc\u30eb\u306b\u4ed8\u4e0e\u3057\u307e\u3057\u305f\u3002<\/p>\n{\n "Version": "2012-10-17",\n "Statement": [\n {\n "Effect": "Allow",\n "Action": [\n "ssmmessages:CreateControlChannel",\n "ssmmessages:CreateDataChannel",\n "ssmmessages:OpenControlChannel",\n "ssmmessages:OpenDataChannel"\n ],\n "Resource": "*"\n },\n {\n "Effect": "Allow",\n "Action": [\n "logs:DescribeLogGroups"\n ],\n "Resource": "*"\n },\n {\n "Effect": "Allow",\n "Action": [\n "logs:CreateLogStream",\n "logs:DescribeLogStreams",\n "logs:PutLogEvents"\n ],\n "Resource": "arn:aws:logs:ap-northeast-1:\u3010AWS\u30a2\u30ab\u30a6\u30f3\u30c8ID\u3011:log-group:\/aws\/ecs\/pure-nginx:*"\n },\n {\n "Effect": "Allow",\n "Action": [\n "s3:PutObject"\n ],\n "Resource": "arn:aws:s3:::\u3010ECS Exec\u5b9f\u884c\u30ed\u30b0\u3092\u4fdd\u5b58\u3059\u308bS3\u30d0\u30b1\u30c3\u30c8\u3011\/*"\n },\n {\n "Effect": "Allow",\n "Action": [\n "s3:GetEncryptionConfiguration"\n ],\n "Resource": "arn:aws:s3:::\u3010ECS Exec\u5b9f\u884c\u30ed\u30b0\u3092\u4fdd\u5b58\u3059\u308bS3\u30d0\u30b1\u30c3\u30c8\u3011"\n },\n {\n "Effect": "Allow",\n "Action": [\n "kms:Decrypt"\n ],\n "Resource": "\u3010KMS KEY\u306eARN\u3011"\n }\n ]\n}<\/code><\/pre>\n
6 ECS Exec\u304c\u6709\u52b9\u304b\u78ba\u8a8d\u3059\u308b\u3002<\/h3>\n
\n\u3053\u306e\u6642\u3001\u65e2\u5b58\u306e\u30bf\u30b9\u30af\u304c\u7a3c\u50cd\u4e2d\u306e\u5834\u5408\u306f\u65b0\u3057\u3044\u30bf\u30b9\u30af\u3092\u8d77\u52d5\u3059\u308b\u5fc5\u8981\u304c\u3042\u308a\u307e\u3059\u3002
\n\u4ee5\u4e0b\u306e\u30b3\u30de\u30f3\u30c9\u3092\u5b9f\u884c\u3057\u3001ECS Exec\u304c\u6709\u52b9\u304b\u78ba\u8a8d\u3057\u307e\u3059\u3002<\/p>\naws ecs describe-tasks \\\n --cluster pure-nginx \\\n --region $AWS_REGION \\\n --tasks \u3010ECS\u306e\u30bf\u30b9\u30afID\u3011<\/code><\/pre>\n
"enableExecuteCommand": true,<\/code><\/pre>\n
7. ECS Exec\u3067\u5bfe\u8a71\u578b\u30b7\u30a7\u30eb\u3092\u5b9f\u884c\u3059\u308b<\/h3>\n
\n\u30b3\u30f3\u30c6\u30ca\u306b\u5bfe\u8a71\u578b\u30b7\u30a7\u30eb\u3067\u30a2\u30af\u30bb\u30b9\u3057\u3066\u307f\u307e\u3059\u3002<\/p>\naws ecs execute-command \\\n --region $AWS_REGION \\\n --cluster pure-nginx \\\n --task \u3010ECS\u306e\u30bf\u30b9\u30afID\u3011 \\\n --container nginx \\\n --command "\/bin\/sh" \\\n --interactive<\/code><\/pre>\n
ubuntu@ip-xxx-xx-xx-xxx:~$ aws ecs execute-command \\\n> --region $AWS_REGION \\\n> --cluster pure-nginx \\\n> --task 03edc749886f4f498f4c6b3a9e12dfd3 \\\n> --container nginx \\\n> --command "\/bin\/sh" \\\n> --interactive\nThe Session Manager plugin was installed successfully. Use the AWS CLI to start a session.\nStarting session with SessionId: ecs-execute-command-00bf245a56342007b\nThis session is encrypted using AWS KMS.\n\/ # \n\/ # \n\/ # ls -l\ntotal 76\ndrwxr-xr-x 2 root root 4096 Mar 31 16:51 bin\ndrwxr-xr-x 5 root root 340 Apr 26 07:27 dev\ndrwxr-xr-x 1 root root 4096 Apr 13 19:21 docker-entrypoint.d\n-rwxrwxr-x 1 root root 1202 Apr 13 19:21 docker-entrypoint.sh\ndrwxr-xr-x 1 root root 4096 Apr 26 07:27 etc\ndrwxr-xr-x 2 root root 4096 Mar 31 16:51 home\ndrwxr-xr-x 1 root root 4096 Mar 31 16:51 lib\ndrwxr-xr-x 3 root root 4096 Apr 26 07:27 managed-agents\ndrwxr-xr-x 5 root root 4096 Mar 31 16:51 media\ndrwxr-xr-x 2 root root 4096 Mar 31 16:51 mnt\ndrwxr-xr-x 2 root root 4096 Mar 31 16:51 opt\ndr-xr-xr-x 102 root root 0 Apr 26 07:27 proc\ndrwx------ 1 root root 4096 Apr 26 07:33 root\ndrwxr-xr-x 1 root root 4096 Apr 26 07:27 run\ndrwxr-xr-x 2 root root 4096 Mar 31 16:51 sbin\ndrwxr-xr-x 2 root root 4096 Mar 31 16:51 srv\ndr-xr-xr-x 13 root root 0 Apr 26 07:27 sys\ndrwxrwxrwt 1 root root 4096 Apr 13 19:21 tmp\ndrwxr-xr-x 1 root root 4096 Mar 31 16:51 usr\ndrwxr-xr-x 1 root root 4096 Mar 31 16:51 var\n\/ # <\/code><\/pre>\n
\u7dcf\u62ec\uff1aAWS Fargate\u306e\u30c8\u30ec\u30fc\u30c9\u30aa\u30d5\u304c\u89e3\u6d88\u3055\u308c\u3001\u307e\u3059\u307e\u3059\u4fbf\u5229\u306b\uff01<\/h2>\n
\u53c2\u7167\u3057\u305f\u60c5\u5831\u306e\u30ea\u30f3\u30af\u5148\uff1a<\/h2>\n
\n