Unable to override taskRoleArn when running ECS task from Lambda

Question

I have a Lambda function that is supposed to pass its own permissions to the code running in an ECS task. It looks like this:
```
    ecs_parameters = {
        "cluster": ...,
        "launchType": "FARGATE",
        "networkConfiguration": ...,
        "overrides": {
            "taskRoleArn": boto3.client("sts").get_caller_identity().get("Arn"),
           ...
        },
        "platformVersion": "LATEST",
        "taskDefinition": f"my-task-definition-{STAGE}",
    }
    response = ecs.run_task(**ecs_parameters)
```
When I run this in Lambda, i get this error:
```
"errorMessage": "An error occurred (ClientException) when calling the RunTask operation: ECS was unable to assume the role 'arn:aws:sts::787364832896:assumed-role/my-lambda-role...' that was provided for this task. Please verify that the role being passed has the proper trust relationship and permissions and that your IAM user has permissions to pass this role."
```
If I change the task definition in ECS to use `my-lambda-role` as the task role, it works. It's specifically when I try to override the task role from Lambda that it breaks.

The Lambda role has the `AWSLambdaBasicExecutionRole` policy and also an inline policy that grants it `ecs:runTask` and `iam:PassRole`. It has a trust relationship that looks like:
```
"Effect": "Allow",
"Principal": {
  "Service": [
      "ecs.amazonaws.com",
      "lambda.amazonaws.com",
      "ecs-tasks.amazonaws.com"
  ]
},
"Action": "sts:AssumeRole"
```
The task definition has a policy that grants it `sts:AssumeRole` and `iam:PassRole`, and a trust relationship that looks like:
```
"Effect": "Allow",
"Principal": {
   "Service": "ecs-tasks.amazonaws.com",
    "AWS": "arn:aws:iam::account-ID:role/aws-service-role/ecs.amazonaws.com/AWSServiceRoleForECS"
},
"Action": "sts:AssumeRole"
```
How do I allow the Lambda function to pass the role to ECS, and ECS to assume the role it's been given?

P.S. - I know a lot of these permissions are overkill, so let me know if there are any I can get rid of :)
Thanks!

Answer

In order for your Lambda function to pass the role to RunTask, the function's execution role policy needs to allow both `ecs:RunTask` and `iam:PassRole`. The policy currently associated with the function does not allow these actions.

Note: The ECS Task Role does not need these permissions. The Task Role only needs those permissions necessary for the functioning of the application itself.

Answer

Hello,

Thank you for clarifying that Lambda execution role has required proper permission to run ECS task and IAM PassRole. The trust relationship policy configuration also looks good, allowing ECS task to assume the role. Here is the general troubleshooting guideline to troubleshoot this issue:

https://aws.amazon.com/premiumsupport/knowledge-center/ecs-unable-to-assume-role/

For further troubleshooting, we will need to look into account specific details. Please reach out to [AWS support](https://docs.aws.amazon.com/awssupport/latest/user/case-management.html) to investigate the issue.

Unable to override taskRoleArn when running ECS task from Lambda

관련 콘텐츠