ECS MANAGED_INSTANCES Capacity Provider fails to provision EC2 instances - Tasks stuck in PROVISIONING status

When tasks remain stuck in PROVISIONING status with a MANAGED_INSTANCES capacity provider, this typically indicates that Amazon ECS is unable to successfully launch the EC2 instances needed to run your tasks. Here are the key areas to investigate:

Infrastructure Role Permissions Verify that your Amazon ECS infrastructure role has the necessary permissions to perform EC2 operations and pass IAM roles. Check the trust relationship between the role and Amazon ECS, ensure it has the required EC2 permissions, and review CloudTrail logs for any encoded authorization failure messages that can reveal specific permission issues.

Network Configuration Ensure your capacity provider is configured with the correct VPC and subnets. Verify that:

• Security groups allow the necessary traffic for Amazon ECS agent communication
• Subnets have sufficient IP addresses available
• Security groups and subnets belong to the same VPC
• The task definition's network configuration (awsvpc network mode) is compatible with the capacity provider

Capacity and Service Quotas Check if you've reached service quotas for the instance type family in your region. You may need to request a service quota increase, consider using different instance types, or terminate unused instances.

Task Definition Compatibility Ensure your task definition is properly configured for MANAGED_INSTANCES by verifying:

• requiresCompatibilities is set to MANAGED_INSTANCES
• The awsvpc network mode is specified
• CPU and memory values are compatible with available instance types

Instance Profile Verify that your capacity provider specifies a valid EC2 instance profile, as this is required for MANAGED_INSTANCES capacity providers.

Regional Capacity Check Amazon EC2 service health in your region for any ongoing issues. Capacity constraints are often temporary, so consider using multiple Availability Zones to improve capacity availability and retry the task launch operation.

Review the specific error messages in your ECS console or CloudTrail logs, as they will provide more detailed information about why the provisioning is failing.
Sources
Troubleshooting Amazon ECS Managed Instances - Amazon Elastic Container Service
Troubleshooting Amazon ECS Amazon ECS Managed Instances errors - Amazon Elastic Container Service

In addition to the above, check the cluster configuration to verify that the capacity provider is actually associated.

aws ecs describe-clusters \
  --clusters your-cluster-name \
  --query 'clusters[].{capacityProviders:capacityProviders,defaultCapacityProviderStrategy:defaultCapacityProviderStrategy}'

If this association is missing or incorrectly configured, ECS will be unable to locate the capacity provider when attempting to run the task; consequently, instance provisioning will not proceed, and the task will remain stuck in the PROVISIONING state.