title: How and why of awslogs on ECS (fargate)
body: <p>I am struggling to get a task running using ECS Fargate, and launched (ecs.runTask) from an AWS SDK script (JS/Node).</p>
  
  <p>My current struggle is to get logs from the containers so that I can trouble shoot why they are stopping. I can't seem to get the Task Definition right so that they will be generated.</p>
  
  <pre><code>    logConfiguration: {
          logDriver: 'awslogs',
          options: {
              "awslogs-region": 'us-west-2',
              "awslogs-group": 'myTask',
              "awslogs-stream-prefix": "myTask",
              "awslogs-create-group": "true"
          }
      }
  </code></pre>
  
  <p>I have set the log driver for them to awslogs, but when I try to view the logs in CloudWatch, I get various kinds of nothing:</p>
  
  <ul>
  <li>If I specify the awslogs-create-group as "true" (it requires a string, rather than a Boolean, which is strange; I assume case doesn't matter), I nevertheless find that the group is not created.</li>
  <li>If I create the group manually, I find that the log stream is not created.</li>
  </ul>
  
  <p>I suspect that there may be an error in my permissions, though of course there is no error messaging to confirm. The docs (<a href="https://docs.aws.amazon.com/AmazonECS/latest/developerguide/using_cloudwatch_logs.html" rel="nofollow noreferrer">here</a>) indicate that I need to attach certain policies to <code>ecsInstanceRole</code>, which seems to be a placeholder for a role that is used <em>somewhere</em> in the process.</p>
  
  <p>But I have attached such a policy to my ECS executionRole, to the role that executes my API call to <code>runTask</code>, and I have looked for any other role that might be involved (an actual "instanceRole" doesn't seem to exist in the Task Def), and nothing is improving my situation.</p>
  
  <p>I'd be happy to supply more information, but at this point I'm not sure where my blind spot is.</p>
  
  <p>Can anyone see it?</p>