amazon-ecs-agent: ecs-agent fails to connect when requiring SecureTransport

Summary

ecs-agent will fail to connect when you have a service control policy requiring the use of tls.

Description

Deploy the following service control policy (terraform syntax):

statement {
  sid       = "RequireSecureTransport"
  effect    = "Deny"
  actions   = ["*"]
  resources = ["*"]
  condition {
    test     = "Bool"
    variable = "aws:SecureTransport"
    values   = ["false"]
  }
}

You’ll see the following behavior:

• the AWS Console ecs dashboard will show the agent as not connected
• no tasks will get scheduled on the host
• you will see the following connection errors in ecs-agent.log: