How to assign IAM Role for ECS Task - amazon-web-services

Question

ECS Tasks can be assigned IAM Roles to make it possible to communicate with AWS APIs without having to pass user credentials to the Task.
This works for both AWS CLI and SDK. There is quite good documentation here but I couldn't find a proper example that covers all the details, I'll create a self-answer question to spare the pain for others.

Answer 1

I created a Git repo with the full example. The important bits are:
Creating an IAM Role Definition with an AssumeRolePolicyDocument.
Assigning the IAM Role to the Task.
Using the AWS JS SDK.
IAMRole:
Type: AWS::IAM::Role
Properties:
RoleName: !Sub role-task-${AWS::StackName} # Doesn't matter too much but let's make it nice anyway
Path: / # No idea about this one but / seems to work
# This is the funky stuff.. don't try to understand just copy-paste. Source: http://docs.aws.amazon.com/AmazonECS/latest/developerguide/task_IAM_role.html
AssumeRolePolicyDocument: |
{
"Statement": [{
"Effect": "Allow",
"Principal": { "Service": [ "ecs-tasks.amazonaws.com" ]},
"Action": [ "sts:AssumeRole" ]
}]
}
Policies:
- PolicyName: !Sub ecs-task-${AWS::StackName}
# You can add any actions here you want your container to be allowed to execute.
PolicyDocument:
{
"Version": "2012-10-17",
"Statement": [{
"Effect": "Allow",
"Action": [
"cloudwatch:PutMetricData" # more actions if needed
],
"Resource": "*"
}]
}
The initialisation of the AWS SDK. The AWS SDK will automatically detect that the container has access to the Role credentials and initialise itself. You don't have to do any initialisation, besides creating the API objects.
var AWS = require('aws-sdk');
var cw = new AWS.CloudWatch();
var s3 = new AWS.S3();