Solved: (invalidparameterexception) when calling the executecommand operation

The error an error occurred (invalidparameterexception) when calling the executecommand operation: the execute command failed because execute command was not enabled when the task was run or the execute command agent isn’t running. wait and try again or run a new task with execute command enabled and try again. likely happens if you do one of the following things:

• You run the aws ecs execute-command to connect with your container running on Amazon ECS but your IAM role or IAM user doesn’t have the required permissions enabled.
• You don’t have the property EnableExecuteCommand enabled on your ECS Service.

In order to fix the error, you first need to validate if you’ve added SSM permissions to our existing ECS task IAM role. This grants permission for the ECS task to connect with the SSM Session Manager service.

{
   "Version": "2012-10-17",
   "Statement": [
       {
       "Effect": "Allow",
       "Action": [
            "ssmmessages:CreateControlChannel",
            "ssmmessages:CreateDataChannel",
            "ssmmessages:OpenControlChannel",
            "ssmmessages:OpenDataChannel"
       ],
      "Resource": "*"
      }
   ]
}

Next, you need to validate if you’ve added the ECS ExecuteCommand permission to your IAM role. Make sure your IAM role contains a policy that allows the action ecs:ExecuteCommand. Otherwise, you’re not able to run aws ecs execute-command in the AWS CLI in order to access the running container.

Add the following policy to your IAM role:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "User access to ECS ExecuteCommand",
            "Effect": "Allow",
            "Action": "ecs:ExecuteCommand",
            "Resource": "*"
        }
    ]
}

At last you need to make sure you’ve enabled the ECS Exec feature on existing and new ECS tasks and services by using the parameter --enable-execute-command.

To enable ECS Exec on an existing ECS service run the following in you AWS CLI:

aws ecs update-service \
    --cluster <cluster-name> \
    --task-definition <task-definition-name> \
    --service <service-name> \
    --enable-execute-command \

If you want to dive deeper on how to successfully run the ecs-execute-command on your ECS containers in AWS, then I’d suggest to read this guide that I wrote.