By using AWS re:Post, you agree to the Terms of Use

Unable to override taskRoleArn when running ECS task from Lambda

1

I have a Lambda function that is supposed to pass its own permissions to the code running in an ECS task. It looks like this:

    ecs_parameters = {
        "cluster": ...,
        "launchType": "FARGATE",
        "networkConfiguration": ...,
        "overrides": {
            "taskRoleArn": boto3.client("sts").get_caller_identity().get("Arn"),
           ...
        },
        "platformVersion": "LATEST",
        "taskDefinition": f"my-task-definition-{STAGE}",
    }
    response = ecs.run_task(**ecs_parameters)

When I run this in Lambda, i get this error:

"errorMessage": "An error occurred (ClientException) when calling the RunTask operation: ECS was unable to assume the role 'arn:aws:sts::787364832896:assumed-role/my-lambda-role...' that was provided for this task. Please verify that the role being passed has the proper trust relationship and permissions and that your IAM user has permissions to pass this role."

If I change the task definition in ECS to use my-lambda-role as the task role, it works. It's specifically when I try to override the task role from Lambda that it breaks.

The Lambda role has the AWSLambdaBasicExecutionRole policy and also an inline policy that grants it ecs:runTask and iam:PassRole. It has a trust relationship that looks like:

"Effect": "Allow",
"Principal": {
  "Service": [
      "ecs.amazonaws.com",
      "lambda.amazonaws.com",
      "ecs-tasks.amazonaws.com"
  ]
},
"Action": "sts:AssumeRole"

The task definition has a policy that grants it sts:AssumeRole and iam:PassRole, and a trust relationship that looks like:

"Effect": "Allow",
"Principal": {
   "Service": "ecs-tasks.amazonaws.com",
    "AWS": "arn:aws:iam::account-ID:role/aws-service-role/ecs.amazonaws.com/AWSServiceRoleForECS"
},
"Action": "sts:AssumeRole"

How do I allow the Lambda function to pass the role to ECS, and ECS to assume the role it's been given?

P.S. - I know a lot of these permissions are overkill, so let me know if there are any I can get rid of :) Thanks!

  • Can you supply the policy statements attached to the Lambda execution role?

  • I'm using the AWS-managed Lambda execution role (if that's what you were asking). "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents" ], "Resource": "*"

2 Answers
0

In order for your Lambda function to pass the role to RunTask, the function's execution role policy needs to allow both ecs:RunTask and iam:PassRole. The policy currently associated with the function does not allow these actions.

Note: The ECS Task Role does not need these permissions. The Task Role only needs those permissions necessary for the functioning of the application itself.

EXPERT
answered 4 months ago
  • Thanks for the response! I think I might have been unclear. The Lambda function also has this inline policy:

    {
        "Version": "2012-10-17",
        "Statement": [
            {
                "Action": [
                    "ecs:runTask",
                    "iam:PassRole"
                ],
                "Resource": "*",
                "Effect": "Allow"
            }
        ]
    }
    

    in addition to the AWSLambdaBasicExecutionRole and various other policies.

  • I should also note that when I try to run this locally, I get:

    botocore.errorfactory.ClientException: An error occurred (ClientException) when calling the RunTask operation: ECS was unable to assume the role 'arn:aws:iam::account-ARN:user/my-user' that was provided for this task. Please verify that the role being passed has the proper trust relationship and permissions and that your IAM user has permissions to pass this role.
    

    My user has Administrator Access, so I believe the problem is on the ECS side rather than on the Lambda side. Let me know if there's any more information I can provide. Thanks!

0

Hello,

Thank you for clarifying that Lambda execution role has required proper permission to run ECS task and IAM PassRole. The trust relationship policy configuration also looks good, allowing ECS task to assume the role. Here is the general troubleshooting guideline to troubleshoot this issue:

https://aws.amazon.com/premiumsupport/knowledge-center/ecs-unable-to-assume-role/

For further troubleshooting, we will need to look into account specific details. Please reach out to AWS support to investigate the issue.

SUPPORT ENGINEER
answered 4 months ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions