Hey Everyone, I was doing some cleanup on the meta...
# dev-metaflowd
damp-lizard-48279
07/01/2021, 10:52 PMHey Everyone, I was doing some cleanup on the metaflow cloudformation template, I came across this Role called
ECSRole✅ 1
s
straight-shampoo-11124
07/01/2021, 11:08 PM@purple-engineer-56290 can you share context about it?
p
purple-engineer-56290
07/02/2021, 12:19 AMThis is anecdotal, but ECSRole seems to be a holdover from an old best-practice in ECS Cloudformation templates to create the "service linked role" required for ECS, as (apparently) there were some situations where it either wouldn't get created, or certain types of environments needed extended permissions for the ECS service.
purple-engineer-56290
07/02/2021, 12:23 AMMost (if not all) of those permissions have been roled into the automatic 'AWSServiceRoleForECS' service-linked role, which now gets linked automagically the same way most service roles do nowadays.
purple-engineer-56290
07/02/2021, 12:26 AMIt's probably safe to remove it, but when we originally pulled over the ECS-endorsed templates to build for Metaflow, it just seemed harmless to leave it alone since the service principal is ecs.amazonaws.com and it already has all those permissions via the service-linked role anyway.
👍 1
d
damp-lizard-48279
07/02/2021, 3:50 AMThanks @purple-engineer-56290 for the detailed background. That makes sense. In that case I’ll remove that. I have tested it out by creating a new Metaflow env without that role and everything seems to be running fine. I’ll do some cleanups and raise a PR
2 Views