Open an interactive shell into a running Fargate container using ECS Exec to debug it in place

Documented steps

1. Attach an IAM policy to the TASK role granting ssmmessages:CreateControlChannel, ssmmessages:CreateDataChannel, ssmmessages:OpenControlChannel, ssmmessages:OpenDataChannel on Resource "*" — required for the SSM agent inside the container to open the session channel.
2. Ensure the task runs on Fargate platform version 1.4.0 (or LATEST) — earlier platform versions do not support ECS Exec.
3. Recommended: add "linuxParameters": {"initProcessEnabled": true} to the container definition so the init process reaps the SSM agent's child processes correctly.
4. Enable ECS Exec at service creation: aws ecs create-service --cluster my-cluster --service-name my-svc --task-definition my-app --desired-count 1 --launch-type FARGATE --enable-execute-command --network-configuration "awsvpcConfiguration={subnets=[subnet-1234],securityGroups=[sg-1234],assignPublicIp=ENABLED}"
5. For an existing service you must roll new tasks: aws ecs update-service --cluster my-cluster --service my-svc --enable-execute-command --force-new-deployment
6. Install the Session Manager plugin for the AWS CLI locally, otherwise execute-command fails with 'SessionManagerPlugin is not found'.
7. Verify the managed agent is up: aws ecs describe-tasks --cluster my-cluster --tasks <task-id> --query 'tasks[0].containers[].managedAgents' — look for ExecuteCommandAgent lastStatus RUNNING.
8. Open the session: aws ecs execute-command --cluster my-cluster --task <task-id> --container my-container --interactive --command "/bin/sh"
9. If it fails, run the AWS-published amazon-ecs-exec-checker script (check-ecs-exec.sh), which validates CLI/jq versions, cluster/task config, IAM permissions, VPC endpoints or NAT egress, and SSM agent status end to end.
10. Official docs: https://docs.aws.amazon.com/AmazonECS/latest/developerguide/ecs-exec.html | https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task-iam-roles.html | https://docs.aws.amazon.com/AmazonECS/latest/developerguide/ecs-exec-troubleshooting.html | https://docs.aws.amazon.com/cli/latest/reference/ecs/execute-command.html