AWS IAM

IAM - Identity and Access Management

IAM Groups

policy group(unit) for easy assign role

IAM user groups - AWS Identity and Access ManagementAWS Identity and Access Management

IAM Custom roles

custom roles for ECS

• AmazonS3FullAccess

• AmazonSSMFullAccess

• AmazonECSTaskExecutionRolePolicy

• custom-roles-for-ECS

here is example custom-roles-for-ECS

custom-roles-for-ECS

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ssm:DescribeParameters"
            ],
            "Resource": "*"
        },
        {
            "Sid": "Stmt1482841904000",
            "Effect": "Allow",
            "Action": [
                "ssm:GetParameters"
            ],
            "Resource": [
                "arn:aws:ssm:us-east-1:{$YOUR_ACCOUNT_ID}:parameter/*"
            ]
        },
        {
            "Sid": "Stmt1482841948000",
            "Effect": "Allow",
            "Action": [
                "kms:Decrypt"
            ],
            "Resource": [
                "arn:aws:kms:us-east-1:{$YOUR_ACCOUNT_ID}:key/{$YOUR_KMS_aws/ssm_KEY}"
            ]
        }
    ]
}

in ECS we will use Parameter Store

AWS Systems Manager -> Shared Resources -> Parameter Store

Parameter Store is centralize environment variable

and when defined Parameter in Parameter Store you can set Type as SecureString in that case the default encryption key is alias/aws/ssm so when run ECS Service task and if you using these Parameter from Parameter Store

for access Parameter need this rules

{
    "Effect": "Allow",
    "Action": [
        "ssm:DescribeParameters"
    ],
    "Resource": "*"
},
{
    "Sid": "Stmt1482841904000",
    "Effect": "Allow",
    "Action": [
        "ssm:GetParameters"
    ],
    "Resource": [
        "arn:aws:ssm:us-east-1:{$YOUR_ACCOUNT_ID}:parameter/*"
    ]
},

https://docs.aws.amazon.com/systems-manager/latest/userguide/sysman-paramstore-access.html

for access encrypt Parameter need this rules

{
    "Sid": "Stmt1482841948000",
    "Effect": "Allow",
    "Action": [
        "kms:Decrypt"
    ],
    "Resource": [
        "arn:aws:kms:us-east-1:{$YOUR_ACCOUNT_ID}:key/{$YOUR_KMS_aws/ssm_KEY}"
    ]
}