How do I troubleshoot permissions issues in Amazon ECS?

Short description

AccessDenied errors occur when the AWS Identity and Access Management (IAM) role that your Amazon ECS resource uses doesn't have the required permissions to run an action on an AWS resource. To resolve this issue, add the missing permissions to the IAM role.

Resolution

To confirm that your IAM role doesn't have the required permissions, check your service event messages and your Amazon ECS task logs for stopped task errors.

You receive the following error message when your Amazon ECS resource's IAM role doesn't have the required permissions:

"User: arn:aws:iam::123456789012:rolename is not authorized to perform: ecs:action on resource: arn:aws:ecs:region:123456789012:resource-type/resource-name"

In the preceding example error message, arn:aws:iam::123456789012:rolename is the IAM role, ecs:action is the missing permission, and arn:aws:ecs:region:123456789012:resource-type/resource-name is the affected resource. Note these values to use in your permissions policy.

Use Amazon ECS managed policies

When you use IAM roles for Amazon ECS, it's a best practice to use Amazon ECS managed policies. Amazon ECS managed policies include the most common required permissions.

To use an Amazon ECS managed policy, complete the following steps:

1. Open the IAM console.
2. In the navigation pane, choose Roles.
3. Select the affected IAM role.
4. Choose Add permissions, and then choose Attach policies directly.
5. In the search bar, enter and select a managed policy based on the required permissions for the IAM role.
6. Choose Next, and then choose Add permissions.
7. To test the permissions, run the operation that failed.

Create an inline policy

To set up custom permissions, create an inline policy based on your permissions requirements, and then attach the policy to the Amazon ECS IAM role.

Related information

Identity and Access Management for Amazon Elastic Container Service

How do I configure my Amazon ECS task to assume an IAM role in another AWS account?