Stepfunction runs into IAMPassRole error on ECS Runtask

0

I am trying to make a step function that will start an ECS Fargate container with environment variables from the input. Whenever I try and run the function I get what seems to be an IAMs error, but I made a new IAMs account with the function. So it should have all of the needed permissions, and the account that I am using has nearly full permissions, so I don't know how it could be an IAMs issue.

{
  "Comment": "A description of my state machine",
  "StartAt": "ECS RunTask",
  "States": {
    "ECS RunTask": {
      "Type": "Task",
      "Resource": "arn:aws:states:::ecs:runTask.sync",
      "Parameters": {
        "LaunchType": "FARGATE",
        "TaskDefinition": "arn:aws:ecs:us-east-1:---:task-definition/---",
        "Overrides": {
          "ContainerOverrides": [
            {
              "Name": "pls work",
              "Environment": [
                {
                  "Name": "INPUT",
                  "Value.$": "$.INPUT"
                }
              ]
            }
          ]
        }
      },
      "Next": "Success"
    },
    "Success": {
      "Type": "Succeed"
    }
  }
}

Here is the error that I am running into:

User: arn:aws:sts::---:assumed-role/StepFunctions-MyStateMachine---/--- is not authorized to perform: iam:PassRole on resource: arn:aws:iam::---:role/ecsTaskExecutionRole because no identity-based policy allows the iam:PassRole action (Service: AmazonECS; Status Code: 400; Error Code: AccessDeniedException; Request ID: ---; Proxy: null)
1개 답변
0
수락된 답변

AWS Step Functions can execute code and access AWS resources but in order to do so you must grant Step Functions access to those resources by using an IAM role. And because Step Functions will call another AWS service like ECS for you, you will need to allow Step Function to pass that role onto the other service. You can find more information on iam:PassRole here: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_passrole.html

profile pictureAWS
전문가
답변함 일 년 전

로그인하지 않았습니다. 로그인해야 답변을 게시할 수 있습니다.

좋은 답변은 질문에 명확하게 답하고 건설적인 피드백을 제공하며 질문자의 전문적인 성장을 장려합니다.

질문 답변하기에 대한 가이드라인

관련 콘텐츠