Wondering how to troubleshoot the ECS tasks for Fargate that are stuck Pending state? We can help you!

As a part of our AWS Support Services, we often receive similar requests from our AWS customers.

Today, let’s see the steps followed by our Support Techs to help our customers to troubleshoot ECS tasks for Fargate that are stuck Pending state.

 

ECS tasks for Fargate are in Pending state

 
A pending state may be due to a slow network, inability to schedule a task due to resources, or some issue with the ECS agent running on underlying EC2 container instances.

Now, let’s see why the tasks for Fargate are in the PENDING state.
 

Check the routes to the internet that uses our subnet

 
Firstly, we need to check what routes to the internet your subnets are using.

• For Fargate tasks in a private subnet, we need to check and verify that our Fargate task has a default route (0.0.0.0/0) to NAT gateway, AWS PrivateLink, or any other source of internet connectivity.

Note that while using PrivateLink, confirm that the security groups for VPC endpoints allow the Fargate to use these security groups.

• Check and verify that our Fargate task has an assigned public IP address and a default route (0.0.0.0/0) to an internet gateway for Fargate tasks in a Public subnet.

For doing this we need to enable the Enable auto-assign public IPv4 address while launching the task.
 

Check VPC endpoints

 
We need to confirm that we have the required endpoints if we are using AWS PrivateLink:

The endpoints required for Fargate platform versions 1.4.0 or later:

• S3 gateway endpoint
• com.amazonaws.region.ecr.api
• com.amazonaws.region.ecr.dkr

For Fargate platform versions 1.3.0 or earlier, the endpoints required are:

• S3 gateway endpoint
• com.amazonaws.region.ecr.dkr

If the task definition uses AWS Secrets Manager, SSM parameters, or Amazon CloudWatch Logs, then we might define the endpoints.
 

Check network ACL and security group settings

 
Check and verify that our network ACL and security groups don’t block outbound access to port 443 from the subnet. To enable outgoing traffic and reach Amazon ECS endpoints, Fargate tasks must have outbound access to port 443.
 

Check the IAM roles and  the permissions

 
To make AWS API calls, the task execution role grants the Amazon ECS container and Fargate agents permission.

Therefore we need to confirm that we have the right permissions for the task execution role for the following scenarios:

• To Pull a container image from Amazon ECR.
• For Using private registry authentication.
• For checking sensitive data using Secrets Manager secrets.
• To use the awslogs log driver.

[Need help with more AWS queries? We’d be happy to assist]
 

Conclusion

 
To conclude, today we discussed the steps followed by our Support Engineers to help our customers to troubleshoot ECS tasks for Fargate that are stuck Pending state.