Unable to override taskRoleArn when running ECS task from Lambda
I have a Lambda function that is supposed to pass its own permissions to the code running in an ECS task. It looks like this:
ecs_parameters = {
"cluster": ...,
"launchType": "FARGATE",
"networkConfiguration": ...,
"overrides": {
"taskRoleArn": boto3.client("sts").get_caller_identity().get("Arn"),
...
},
"platformVersion": "LATEST",
"taskDefinition": f"my-task-definition-{STAGE}",
}
response = ecs.run_task(**ecs_parameters)
When I run this in Lambda, i get this error:
"errorMessage": "An error occurred (ClientException) when calling the RunTask operation: ECS was unable to assume the role 'arn:aws:sts::787364832896:assumed-role/my-lambda-role...' that was provided for this task. Please verify that the role being passed has the proper trust relationship and permissions and that your IAM user has permissions to pass this role."
If I change the task definition in ECS to use my-lambda-role
as the task role, it works. It's specifically when I try to override the task role from Lambda that it breaks.
The Lambda role has the AWSLambdaBasicExecutionRole
policy and also an inline policy that grants it ecs:runTask
and iam:PassRole
. It has a trust relationship that looks like:
"Effect": "Allow",
"Principal": {
"Service": [
"ecs.amazonaws.com",
"lambda.amazonaws.com",
"ecs-tasks.amazonaws.com"
]
},
"Action": "sts:AssumeRole"
The task definition has a policy that grants it sts:AssumeRole
and iam:PassRole
, and a trust relationship that looks like:
"Effect": "Allow",
"Principal": {
"Service": "ecs-tasks.amazonaws.com",
"AWS": "arn:aws:iam::account-ID:role/aws-service-role/ecs.amazonaws.com/AWSServiceRoleForECS"
},
"Action": "sts:AssumeRole"
How do I allow the Lambda function to pass the role to ECS, and ECS to assume the role it's been given?
P.S. - I know a lot of these permissions are overkill, so let me know if there are any I can get rid of :) Thanks!
I'm using the AWS-managed Lambda execution role (if that's what you were asking). "Effect": "Allow", "Action": "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents" , "Resource": "*"
In order for your Lambda function to pass the role to RunTask, the function's execution role policy needs to allow both ecs:RunTask
and iam:PassRole
. The policy currently associated with the function does not allow these actions.
Note: The ECS Task Role does not need these permissions. The Task Role only needs those permissions necessary for the functioning of the application itself.
Thanks for the response! I think I might have been unclear. The Lambda function also has this inline policy:
{ "Version": "2012-10-17", "Statement": [ { "Action": [ "ecs:runTask", "iam:PassRole" ], "Resource": "*", "Effect": "Allow" } ] }
in addition to the AWSLambdaBasicExecutionRole and various other policies.
I should also note that when I try to run this locally, I get:
botocore.errorfactory.ClientException: An error occurred (ClientException) when calling the RunTask operation: ECS was unable to assume the role 'arn:aws:iam::account-ARN:user/my-user' that was provided for this task. Please verify that the role being passed has the proper trust relationship and permissions and that your IAM user has permissions to pass this role.
My user has Administrator Access, so I believe the problem is on the ECS side rather than on the Lambda side. Let me know if there's any more information I can provide. Thanks!
Hello,
Thank you for clarifying that Lambda execution role has required proper permission to run ECS task and IAM PassRole. The trust relationship policy configuration also looks good, allowing ECS task to assume the role. Here is the general troubleshooting guideline to troubleshoot this issue:
https://aws.amazon.com/premiumsupport/knowledge-center/ecs-unable-to-assume-role/
For further troubleshooting, we will need to look into account specific details. Please reach out to AWS support to investigate the issue.
Relevant questions
Charging operate Task for execution time
Accepted Answerasked 5 months agoUnable to override taskRoleArn when running ECS task from Lambda
asked 7 days agoCloudwatch Event ECS payload?
asked 3 years agoAWS Step Function Output for container services
asked 5 days agoECS Container and Docker
asked 5 months agoWrite containerOverwrites from Lambda to Container
asked 5 months agoThe "new" Amazon ECS Console is missing fundamental options like container command overrides
asked 3 months agoHow to convince EventBridge to pass S3 event information to an ecs target?
Accepted AnswerHow to I troubleshoot a deploy that is forever in "IN_PROGRESS"?
asked 6 months agoWhat needs to be done to make event bridge invoke a fargate task when file added to s3
asked 21 days ago
Can you supply the policy statements attached to the Lambda execution role?