Question: a list of ["A","A","A","B","B","B"]

to dictionary of
{'A': 3,
 'B': 3}

I've done something like below but i feel like there is a faster/shorter way of doing it?

```
frequencyMap = dict()
letters = ["A","A","A","B","B","B"]

for letter in letters:
    if letter not in frequencyMap:
        frequencyMap[letter] = 0
    frequencyMap[letter] += 1

```

Answer: 
I've discovered the answer after tracing through CloudTrail. There were two permissions missing from the CodePipeline deployment role which I can't find documented, they are `ecs:RegisterTaskDefinition` and `iam:PassRole` for the ECS Container role. CodeDeploy assumes a different role during deployment that also needs these permissions, but it looks like CodePipeline needs them to start the deployment.

The documentation I was working off had an example for CodeDeploy cross-account, but this was CodeDeploy to EC2 rather than to ECS.

My final permissions for the role assumed in Account B by CodePipeline looks like:

```
{
  "Version": "2012-10-17",
  "Statement": [
    {
        "Action": [
            "codedeploy:CreateDeployment",
            "codedeploy:GetDeployment",
            "codedeploy:GetDeploymentConfig",
            "codedeploy:GetApplicationRevision",
            "codedeploy:RegisterApplicationRevision",
            "codedeploy:GetApplication",
            "ecs:RegisterTaskDefinition"
        ],
        "Resource": "*",
        "Effect": "Allow"
    },
    {
        "Action": [
            "s3:GetObject*",
            "s3:PutObject",
            "s3:PutObjectAcl"
        ],
        "Resource": "arn:aws:s3:::deployment_intermediate_bucket/*",
        "Effect": "Allow"
    },
    {
        "Action": [ "s3:ListBucket"],
        "Resource": "arn:aws:s3:::deployment_intermediate_bucket",
        "Effect": "Allow"
    },
    {
        "Effect": "Allow",
        "Action": [
            "kms:DescribeKey",
            "kms:GenerateDataKey*",
            "kms:Encrypt",
            "kms:ReEncrypt*",
            "kms:Decrypt"
        ],
        "Resource": [
            "deployment_kms_key_arn"
        ]
    },
    {
        "Action": [
            "iam:PassRole"
        ],
        "Effect": "Allow",
        "Resource": "ecs_container_role_arn"
    }
  ]
}

```

I'm going to reduce this down to the minimum required.
To maybe help here, having had the same issue/error:

Using Cloud-formation, I have a pipeline in account a, with an ecs bluegreen action in account b (TestingAccount):

```
        - Name: !Sub BlueGreenDeploy
          Actions:
            - Name: BlueGreenDeploy
              InputArtifacts:
              # - Name: PrepareCodeDeployOutput
              - Name: !Ref SourceArtifactName
              Region: !Ref DeployRegion1
              ActionTypeId:
                Category: Deploy
                Owner: AWS
                Version: '1'
                Provider: CodeDeployToECS
              RoleArn: !Sub arn:aws:iam::${TestingAccountId}:role/######/CrossAccountsDeploymentRole
              Configuration:

                AppSpecTemplateArtifact: !Ref SourceArtifactName
                AppSpecTemplatePath: appspec.json

                ApplicationName: ronantest1
                DeploymentGroupName: ronantest1

                TaskDefinitionTemplateArtifact: !Ref SourceArtifactName
                TaskDefinitionTemplatePath: taskdef.json

                Image1ArtifactName: !Ref SourceArtifactName
                Image1ContainerName: "IMAGE1_NAME"
              RunOrder: 4

```

In the task definition that I was trying to deploy, I had the following roles listed:

```
    "taskRoleArn"
    "executionRoleArn"

```

The role that the pipeline assumed in the target account, i.e:

```
   arn:aws:iam::${TestingAccountId}:role/######/CrossAccountsDeploymentRole

```

It needed to be able to pass both those roles listed in the Task definition.

Hope that makes sense and helps. AWS does not make this stuff easy from their documentation.