[ECS EC2] ECS Agent reachable from Linux containers but not from Windows containers about amazon-ecs-agent

[rawahars]

Thanks for bringing this to our notice. We will add the support for this in October month's AMI release for Windows.

I will update more details soon.

[rawahars]

The fix for this issue was released with November 2023 AMIs.

During instance bootstrap, you can set ECSAllowOffHostIntrospectionAccess switch for the Initialize-ECSAgent method. Alternatively, you can also set ECS_ALLOW_OFFHOST_INTROSPECTION_ACCESS env to true for enabling access to introspection API. This env is documented here- https://github.com/aws/amazon-ecs-agent#environment-variables

The new user data would be similar to-

<powershell>
Import-Module ECSTools
[Environment]::SetEnvironmentVariable(“ECS_LOGLEVEL_ON_INSTANCE”,”debug", “Machine”)
Initialize-ECSAgent -Cluster 'windows' -EnableTaskENI -EnableTaskIAMRole -AwsvpcBlockIMDS -ECSAllowOffHostIntrospectionAccess
</powershell>

or

<powershell>
Import-Module ECSTools
[Environment]::SetEnvironmentVariable(“ECS_LOGLEVEL_ON_INSTANCE”,”debug", “Machine”)
[Environment]::SetEnvironmentVariable(“ECS_ALLOW_OFFHOST_INTROSPECTION_ACCESS”,”true", “Machine”)
Initialize-ECSAgent -Cluster 'windows' -EnableTaskENI -EnableTaskIAMRole -AwsvpcBlockIMDS
</powershell>

[rawahars]

We will be updating the init script for Windows in November release since we need to add additional tests to ensure this functionality does not regress in the future.