<p>IAM Role for Fargate has <strong>two policies</strong>:</p>

<ol>
<li><p>The first one describes which service can assume the role and its permissions. In this case it will be the <code>ecs-tasks.amazonaws.com</code> service (= Fargate) that can call <code>sts:AssumeRole</code> to get all the permissions from this Role.</p></li>
<li><p>When Fargate <em>assumes</em> the role it gets the permissions specified within, these are the SSM, KMS and SecretsManager permissions.</p></li>
</ol>

<p>If you are using CloudFormation you can do something like this:</p>

<pre><code>  FargateRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        # This says that Fargate can assume this role
        Version: '2012-10-17'
        Statement:
        - Action: sts:AssumeRole
          Effect: Allow
          Principal:
            Service: ecs-tasks.amazonaws.com
      Path: /
      Policies:
      - PolicyName: FargatePermissions
        PolicyDocument:
          # This says what permissions will 
          # the Fargate container receive
          Statement:
          - Action:
            - ssm:GetParameters
            - secretsmanager:GetSecretValue
            - kms:Decrypt
            Effect: Allow
            Resource: '*'
</code></pre>

<p>If you are building the role manually in the console be sure to select in the first step that it's an <em>IAM Role</em> for <em>ECS Task</em>, that will create the equivalent of <code>AssumeRolePolicyDocument</code> from the above code snippet.</p>

<p><a href="https://i.sstatic.net/3NSJT.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/3NSJT.png" alt="IAM Role Configuration"></a></p>

<p>Then in the next step add the policy <em>without</em> the <code>sts:AssumeRole</code>:</p>

<pre><code>{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "secretsmanager:GetSecretValue",
                "ssm:GetParameters",
                "kms:Decrypt"
            ],
            "Resource": "*"
        }
    ]
}
</code></pre>

<p>That should create the IAM Role you need. Ideally you should also restrict the access only to specific resources instead of using <code>"Resource": "*"</code> but for start it's easier to just use the wildcard.</p>

<p>Hope that helps :)</p>

CC BY-SA 4.0
2019-12-31T05:33:22.297Z
As a wrinkle, I'm trying to build this infrastructure using Terraform, which means I can't use the console directly.  I can use the console to create the role once to see what it does, but then I need to translate it to Terraform somehow so I can maintain it.  Is there an easy way to do this?
Ertai87
CC BY-SA 4.0
2019-12-30T22:16:13.233Z
2019-12-30T22:16:13.233Z
MLu
<p>The answer was that my IAM configuration did not include a Task Role, only a Task Execution Role.  I needed to add a Task Role which included the permissions I needed to access SSM, and then it worked.</p>

CC BY-SA 4.0
2019-12-31T18:25:14.820Z
2019-12-31T18:25:14.820Z
Ertai87
<p>I'm trying to create some infrastructure for a service I am building on AWS using AWS Fargate.  I'm using SSM as a value store for some of my application configuration, so I need both the regular permissions for Fargate as well as additional permissions for SSM.  However, after banging my head against this particular wall for a while, I've come to the conclusion that I just don't understand AWS IAM in general or this problem in particular, so I'm here for help.</p>

<p>The basis of my IAM code comes from <a href="https://medium.com/@bradford_hamilton/deploying-containers-on-amazons-ecs-using-fargate-and-terraform-part-2-2e6f6a3a957f" rel="nofollow noreferrer">this tutorial</a>; the IAM code is actually not in that tutorial but rather in <a href="https://github.com/bradford-hamilton/terraform-ecs-fargate/blob/master/terraform/roles.tf" rel="nofollow noreferrer">this file</a> in the github repo linked to that tutorial.  I presume I need to retain that STS permission for something although I'm not entirely sure what.</p>

<p>I've converted the IAM code from the tutorial into a JSON document because I find JSON easier to work with than the Terraform native thing.  Here's what I've come up with.  It doesn't work.  I would like to know why it doesn't work and how to fix it.  Please ELI5 (explain like I'm 5 years old) because I know nothing about this.</p>

<pre><code>{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ssm:GetParameters",
        "secretsmanager:GetSecretValue",
        "kms:Decrypt",
        "sts:AssumeRole"
      ],
      "Principal": {
        "Service": ["ecs-tasks.amazonaws.com"]
      }
    }
  ]
}
</code></pre>

CC BY-SA 4.0
2019-12-30T21:07:35.387Z
What kind of "It doesn't work" do you experience?
MLu
CC BY-SA 4.0
2019-12-30T21:12:44.510Z
@MLu This particular implementation gives me the error message (from Terraform): "Error: Error creating IAM Role ecs-default-task-execution-role: MalformedPolicyDocument: AssumeRole policy may only specify STS AssumeRole actions".  I've tried other options that have given me other error messages as well.
Ertai87
<amazon-web-services><aws-iam><fargate>
AWS permissions for Fargate and SSM
Ertai87
# AWS permissions for Fargate and SSM

(Asked by: username_0 on 2019-12-30)

I'm trying to create some infrastructure for a service I am building on AWS using AWS Fargate.  I'm using SSM as a value store for some of my application configuration, so I need both the regular permissions for Fargate as well as additional permissions for SSM.  However, after banging my head against this particular wall for a while, I've come to the conclusion that I just don't understand AWS IAM in general or this problem in particular, so I'm here for help.
The basis of my IAM code comes from this tutorial; the IAM code is actually not in that tutorial but rather in this file in the github repo linked to that tutorial.  I presume I need to retain that STS permission for something although I'm not entirely sure what.
I've converted the IAM code from the tutorial into a JSON document because I find JSON easier to work with than the Terraform native thing.  Here's what I've come up with.  It doesn't work.  I would like to know why it doesn't work and how to fix it.  Please ELI5 (explain like I'm 5 years old) because I know nothing about this.
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ssm:GetParameters",
        "secretsmanager:GetSecretValue",
        "kms:Decrypt",
        "sts:AssumeRole"
      ],
      "Principal": {
        "Service": ["ecs-tasks.amazonaws.com"]
      }
    }
  ]
}

**Tags:** amazon-web-services, aws-iam, fargate

> **Comments:**
> **username_1**: What kind of "It doesn't work" do you experience?  
> **username_0**: @username_1 This particular implementation gives me the error message (from Terraform): "Error: Error creating IAM Role ecs-default-task-execution-role: MalformedPolicyDocument: AssumeRole policy may only specify STS AssumeRole actions".  I've tried other options that have given me other error messages as well.  

---

## 2 answers

### Answer by username_1 on 2019-12-30. Score: 1

IAM Role for Fargate has two policies:

The first one describes which service can assume the role and its permissions. In this case it will be the ecs-tasks.amazonaws.com service (= Fargate) that can call sts:AssumeRole to get all the permissions from this Role.
When Fargate assumes the role it gets the permissions specified within, these are the SSM, KMS and SecretsManager permissions.

If you are using CloudFormation you can do something like this:
  FargateRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        # This says that Fargate can assume this role
        Version: '2012-10-17'
        Statement:
        - Action: sts:AssumeRole
          Effect: Allow
          Principal:
            Service: ecs-tasks.amazonaws.com
      Path: /
      Policies:
      - PolicyName: FargatePermissions
        PolicyDocument:
          # This says what permissions will 
          # the Fargate container receive
          Statement:
          - Action:
            - ssm:GetParameters
            - secretsmanager:GetSecretValue
            - kms:Decrypt
            Effect: Allow
            Resource: '*'

If you are building the role manually in the console be sure to select in the first step that it's an IAM Role for ECS Task, that will create the equivalent of AssumeRolePolicyDocument from the above code snippet.

Then in the next step add the policy without the sts:AssumeRole:
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "secretsmanager:GetSecretValue",
                "ssm:GetParameters",
                "kms:Decrypt"
            ],
            "Resource": "*"
        }
    ]
}

That should create the IAM Role you need. Ideally you should also restrict the access only to specific resources instead of using "Resource": "*" but for start it's easier to just use the wildcard.
Hope that helps :)

> **Comments:**
> **username_0**: As a wrinkle, I'm trying to build this infrastructure using Terraform, which means I can't use the console directly.  I can use the console to create the role once to see what it does, but then I need to translate it to Terraform somehow so I can maintain it.  Is there an easy way to do this?  

---

### Answer by username_0 on 2019-12-31. Score: 0

The answer was that my IAM configuration did not include a Task Role, only a Task Execution Role. I needed to add a Task Role which included the permissions I needed to access SSM, and then it worked.


---

