IAM permissions for ECS RunTask?

[brianle1301]

Confirm by changing [ ] to [x] below:

• I've gone through Developer Guide and API reference
• I've checked AWS Forums and StackOverflow for answers

Describe the question
I am trying to provision ECS Fargate tasks from an Elastic Beanstalk environment using IAM roles. The policy is configured like so:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "ecs:RunTask",
                "ecs:StopTask"
            ],
            "Resource": [
                "arn:aws:ecs:us-east-2:495060551088:task-definition/my-definition:*",
                "arn:aws:ecs:us-east-2:495060551088:task/*"
            ]
        }
    ]
}

However, I received the AccessDeniedException when requesting tasks

const client = new ECS({ region: 'us-east-2' });

client.runTask({
            cluster: process.env.ECS_CLUSTER,
            taskDefinition: 'my-definition:7,
            launchType: 'FARGATE',
            networkConfiguration: {
                awsvpcConfiguration: {
                    subnets: process.env.SUBNETS.split(','),
                    assignPublicIp: 'ENABLED',
                },
            },
            overrides: {
                containerOverrides: [
                    {
                        name: 'container',
                        environment: [
                            { name: 'API_KEY', value: apiKey },
                        ],
                    },
                ],
            },
        })

What are the minimal IAM permissions I need to set for the above to work? I tried Full Access and it worked, which kind of makes sense.

Thanks in advance.

[ajredniwja]

Hi @brianle1301, thanks for opening this issue, you can use something like mentioned in https://docs.aws.amazon.com/AmazonECS/latest/userguide/task-iam-roles.html

Or try policy generator to then expand and mark all the related operations.

Can help you specify permissions if the above doesn't work for you.

[github-actions[bot]]

This issue has not received a response in 1 week. If you still think there is a problem, please leave a comment to avoid the issue from automatically closing.

[brianle1301]

@ajredniwja Hi and thanks for the response. I'm pretty sure I had a look at both of those and still could not figure out why StopTask and RunTask are insufficient. I will try again though as it has been a while

[chandankj399]

Having these permissions helped me solve the issue
"iam:Get*",
"iam:List*",
"iam:Generate*",
"iam:PassRole",

[lacatus]

More on the topic => https://stackoverflow.com/a/70639428

[github-actions[bot]]

Hello! Reopening this discussion to make it searchable.