Stepfunction runs into IAMPassRole error on ECS Runtask

0

I am trying to make a step function that will start an ECS Fargate container with environment variables from the input. Whenever I try and run the function I get what seems to be an IAMs error, but I made a new IAMs account with the function. So it should have all of the needed permissions, and the account that I am using has nearly full permissions, so I don't know how it could be an IAMs issue.

{
  "Comment": "A description of my state machine",
  "StartAt": "ECS RunTask",
  "States": {
    "ECS RunTask": {
      "Type": "Task",
      "Resource": "arn:aws:states:::ecs:runTask.sync",
      "Parameters": {
        "LaunchType": "FARGATE",
        "TaskDefinition": "arn:aws:ecs:us-east-1:---:task-definition/---",
        "Overrides": {
          "ContainerOverrides": [
            {
              "Name": "pls work",
              "Environment": [
                {
                  "Name": "INPUT",
                  "Value.$": "$.INPUT"
                }
              ]
            }
          ]
        }
      },
      "Next": "Success"
    },
    "Success": {
      "Type": "Succeed"
    }
  }
}

Here is the error that I am running into:

User: arn:aws:sts::---:assumed-role/StepFunctions-MyStateMachine---/--- is not authorized to perform: iam:PassRole on resource: arn:aws:iam::---:role/ecsTaskExecutionRole because no identity-based policy allows the iam:PassRole action (Service: AmazonECS; Status Code: 400; Error Code: AccessDeniedException; Request ID: ---; Proxy: null)
1 個回答
0
已接受的答案

AWS Step Functions can execute code and access AWS resources but in order to do so you must grant Step Functions access to those resources by using an IAM role. And because Step Functions will call another AWS service like ECS for you, you will need to allow Step Function to pass that role onto the other service. You can find more information on iam:PassRole here: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_passrole.html

profile pictureAWS
專家
已回答 1 年前

您尚未登入。 登入 去張貼答案。

一個好的回答可以清楚地回答問題並提供建設性的意見回饋,同時有助於提問者的專業成長。

回答問題指南