2

I have multiple Fargate clusters in a single AWS account. I wish to ensure that a given service account (used by the build pipeline) can only update Services within a given Fargate clusters.

The IAM policy editor prompt for the ecs:UpdateService action's resource is arn:aws:ecs::<aws_account_id>:service/ which doesn't make sense given that different clusters can have Services that share a name. aws ecs describe-tasks shows both a "clusterArn" and "serviceArn" for each task. aws ecs list-services and aws ecs describe-services only apply to Services for a given cluster.

Improve this question

1 Answer 1

Reset to default
2

I created a policy that restricts the ecs:UpdateService action to only be able to update the arn:aws:ecs:<region>:<aws_account_id>:<service> resource, with a "StringEquals" condition specifying a ecs:cluster condition key set to the ARN of the ECS cluster. Using this method, you could give * for <service> to allow a policy to update all services in a given cluster.

Documentation: Actions, resources, and condition keys for Amazon Elastic Container Service

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .