[JIRA] (JENKINS-54898) ECS Plugin 1.18 cannot launch slaves

[bigs...@gmail.com (JIRA)]

Title: Message Title

Aidan Carter created an issue   Jenkins / JENKINS-54898 ECS Plugin 1.18 cannot launch slaves Issue Type: Bug Assignee: Jan Roehrich Components: amazon-ecs-plugin Created: 2018-11-27 23:10 Environment: Jenkins 2.138.2 amazon-ecs 1.18 Priority: Major Reporter: Aidan Carter After upgrading from v1.16 to 1.18 of the ECS plugin, no ECS slaves were able to be launched. We are using EC2 as the launch type (not fargate). The error message in the log is as follows: [digital-ci-devops-zv5qp]: Error in provisioning; agent=com.cloudbees.jenkins.plugins.amazonecs.ECSSlave[digital-ci-devops-zv5qp] com.amazonaws.services.ecs.model.AccessDeniedException: User: arn:aws:sts::[******]:assumed-role/[******] is not authorized to perform: iam:PassRole on resource: arn:aws:iam::[******]:role/ecsTaskExecutionRole (Service: AmazonECS; Status Code: 400; Error Code: AccessDeniedException; Request ID: [******]) at com.amazonaws.http.AmazonHttpClient$RequestExecutor.handleErrorResponse(AmazonHttpClient.java:1658) at com.amazonaws.http.AmazonHttpClient$RequestExecutor.executeOneRequest(AmazonHttpClient.java:1322) [...] I was able to fix the problem by going into the build slave configuration and changing the field "Task Execution Role ARN" from the default value of "ecsTaskExecutionRole" to "" (empty string). However, if an admin opens the jenkins system config, all the build slave configs (20+) will have the "Task Execution Role ARN" field reset back to their default value. If the config is saved, the problem will reoccur What I believe is happening is that on v1.18, the plugin is incorrectly applying the task execution role to EC2 launch type slaves (should only be applied to fargate launch type). Reverting the plugin back to v1.16 resolved the problem. Add Comment   This message was sent by Atlassian Jira (v7.11.2#711002-sha1:fdc329d) -- You received this message because you are subscribed to the Google Groups "Jenkins Issues" group. To unsubscribe from this group and stop receiving emails from it, send an email to jenkinsci-issues+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.