I have been struggling for hours to push a message to SQS from a running ECS container. I have done the following:
- Added all available SQS policies to ECS task execution role
- Added access policy to SQS giving full rights to ECS task execution role
- Added VPC endpoint allowing everything and anything
Yet when my container application attempts to post a message to a queue (tested and working) boto3 raises NoCredentialsError. From what I read, setting up IAM roles should resolve this but it is not working for me. I have given overly broad access in all of these cases in an attempt to just get something to work.
Are there any other steps I need to take to allow my ECS container to interact with SQS?
Here are the configurations as mentioned above:
IAM policy attached to ecsTaskExecutionRole:
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "VisualEditor0",
"Effect": "Allow",
"Action": [
"sqs:DeleteMessage",
"sqs:GetQueueUrl",
"sqs:ChangeMessageVisibility",
"sqs:ReceiveMessage",
"sqs:SendMessage",
"sqs:GetQueueAttributes",
"sqs:ListQueueTags",
"sqs:ListDeadLetterSourceQueues",
"sqs:PurgeQueue",
"sqs:DeleteQueue",
"sqs:CreateQueue",
"sqs:SetQueueAttributes"
],
"Resource": "arn:aws:sqs:*:<account>:*"
}
]
}
SQS access policy (NOTE: initially tried setting service instead of principal):
{
"Version": "2012-10-17",
"Id": "__default_policy_ID",
"Statement": [
{
"Sid": "__owner_statement",
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::<account>:role/ecsTaskExecutionRole"
},
"Action": "SQS:*",
"Resource": "arn:aws:sqs:us-east-1:<account>:messages"
}
]
}
VPC Endpoint Policy:
{
"Statement": [
{
"Action": "*",
"Effect": "Allow",
"Principal": "*",
"Resource": "*"
}
]
}
The VPC endpoint is attached to the all subnets in the VPC (I only have one in the account).
Why am I still getting NoCredentialsError in ECS when attempting to write to the queue? Is this even possible?
You are absolutely right. I stumbled upon a similar answer somewhere else and was just about to come back and answer my own question. I think I think I knew this at some point so a bit ta of a face-palm for me. Thanks and hopefully this helps someone else.