aws exec command timeout error

[shreyatandon16]

I am using AWS exec command in my command prompt, when I am running the command I am getting the following error

aws ecs execute-command --cluster anomaly-notification --task --container --interactive --command "/bin/bash"

The Session Manager plugin was installed successfully. Use the AWS CLI to start a session.

An error occurred (TargetNotConnectedException) when calling the ExecuteCommand operation: The execute command failed due to an internal error. Try again later.

when I troubleshooter this error and checked in stack overflow as well, they mentioned ssm which when checked is enabled.

Another thing is that my exec agent is always in running state instead of Active.

can anyone who has encountered this issue before help?!

[uldyssian-sh]

TargetNotConnectedException for aws ecs execute-command is almost never a “CLI timeout” problem. It means ECS Exec could not establish the SSM data channel to the container because one of the Exec prerequisites is not satisfied.

The most common causes are:

ECS Exec was not enabled on the service/task.

You must enable Exec on the service (or run-task) and then start a NEW task after enabling it:

aws ecs update-service
--cluster anomaly-notification
--service <SERVICE_NAME>
--enable-execute-command

Then force a new deployment (so new tasks start with Exec enabled):

aws ecs update-service
--cluster anomaly-notification
--service <SERVICE_NAME>
--force-new-deployment

Missing IAM permissions.

Both are required:

1. The task role (or execution role, depending on your setup) must allow SSM message channels (these are the typical permissions):
   ssmmessages:CreateControlChannel
   ssmmessages:CreateDataChannel
   ssmmessages:OpenControlChannel
   ssmmessages:OpenDataChannel

2. The caller running aws ecs execute-command must have:
   ecs:ExecuteCommand
   and permission to use SSM session channels.

Networking prevents the task from reaching SSM endpoints.

Your tasks must be able to reach Systems Manager endpoints over HTTPS (443). If tasks are in private subnets, they need:

• NAT to the internet, or
• VPC endpoints for SSM/SSMMessages/EC2Messages (recommended).

If the “exec agent” stays in “RUNNING” and never becomes “ACTIVE”, that strongly points to the network/IAM prerequisites above (it can’t phone home).

Also verify you are providing the required parameters (task and container):

aws ecs execute-command
--cluster anomaly-notification
--task <TASK_ID>
--container <CONTAINER_NAME>
--interactive
--command "/bin/bash"

Once Exec is enabled on the service, the task is restarted, IAM is correct, and the task can reach SSM endpoints, the Exec agent will show as ACTIVE and the command will work.

[uldyssian-sh]

Thanks! If this helps, please consider marking it as “Helpful” or “Accepted” 😊