Answers: <p>IAM Role for Fargate has <strong>two policies</strong>:</p>
  
  <ol>
  <li><p>The first one describes which service can assume the role and its permissions. In this case it will be the <code>ecs-tasks.amazonaws.com</code> service (= Fargate) that can call <code>sts:AssumeRole</code> to get all the permissions from this Role.</p></li>
  <li><p>When Fargate <em>assumes</em> the role it gets the permissions specified within, these are the SSM, KMS and SecretsManager permissions.</p></li>
  </ol>
  
  <p>If you are using CloudFormation you can do something like this:</p>
  
  <pre><code>  FargateRole:
      Type: AWS::IAM::Role
      Properties:
        AssumeRolePolicyDocument:
          # This says that Fargate can assume this role
          Version: '2012-10-17'
          Statement:
          - Action: sts:AssumeRole
            Effect: Allow
            Principal:
              Service: ecs-tasks.amazonaws.com
        Path: /
        Policies:
        - PolicyName: FargatePermissions
          PolicyDocument:
            # This says what permissions will 
            # the Fargate container receive
            Statement:
            - Action:
              - ssm:GetParameters
              - secretsmanager:GetSecretValue
              - kms:Decrypt
              Effect: Allow
              Resource: '*'
  </code></pre>
  
  <p>If you are building the role manually in the console be sure to select in the first step that it's an <em>IAM Role</em> for <em>ECS Task</em>, that will create the equivalent of <code>AssumeRolePolicyDocument</code> from the above code snippet.</p>
  
  <p><a href="https://i.sstatic.net/3NSJT.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/3NSJT.png" alt="IAM Role Configuration"></a></p>
  
  <p>Then in the next step add the policy <em>without</em> the <code>sts:AssumeRole</code>:</p>
  
  <pre><code>{
      "Version": "2012-10-17",
      "Statement": [
          {
              "Effect": "Allow",
              "Action": [
                  "secretsmanager:GetSecretValue",
                  "ssm:GetParameters",
                  "kms:Decrypt"
              ],
              "Resource": "*"
          }
      ]
  }
  </code></pre>
  
  <p>That should create the IAM Role you need. Ideally you should also restrict the access only to specific resources instead of using <code>"Resource": "*"</code> but for start it's easier to just use the wildcard.</p>
  
  <p>Hope that helps :)</p>
  
Answers: CC BY-SA 4.0
Answers: 2019-12-31T05:33:22.297Z
Answers: As a wrinkle, I'm trying to build this infrastructure using Terraform, which means I can't use the console directly.  I can use the console to create the role once to see what it does, but then I need to translate it to Terraform somehow so I can maintain it.  Is there an easy way to do this?
Answers: Ertai87
Answers: CC BY-SA 4.0
Answers: 2019-12-30T22:16:13.233Z
Answers: 2019-12-30T22:16:13.233Z
Answers: MLu
Answers: <p>The answer was that my IAM configuration did not include a Task Role, only a Task Execution Role.  I needed to add a Task Role which included the permissions I needed to access SSM, and then it worked.</p>
  
Answers: CC BY-SA 4.0
Answers: 2019-12-31T18:25:14.820Z
Answers: 2019-12-31T18:25:14.820Z
Answers: Ertai87
Body: <p>I'm trying to create some infrastructure for a service I am building on AWS using AWS Fargate.  I'm using SSM as a value store for some of my application configuration, so I need both the regular permissions for Fargate as well as additional permissions for SSM.  However, after banging my head against this particular wall for a while, I've come to the conclusion that I just don't understand AWS IAM in general or this problem in particular, so I'm here for help.</p>
  
  <p>The basis of my IAM code comes from <a href="https://medium.com/@bradford_hamilton/deploying-containers-on-amazons-ecs-using-fargate-and-terraform-part-2-2e6f6a3a957f" rel="nofollow noreferrer">this tutorial</a>; the IAM code is actually not in that tutorial but rather in <a href="https://github.com/bradford-hamilton/terraform-ecs-fargate/blob/master/terraform/roles.tf" rel="nofollow noreferrer">this file</a> in the github repo linked to that tutorial.  I presume I need to retain that STS permission for something although I'm not entirely sure what.</p>
  
  <p>I've converted the IAM code from the tutorial into a JSON document because I find JSON easier to work with than the Terraform native thing.  Here's what I've come up with.  It doesn't work.  I would like to know why it doesn't work and how to fix it.  Please ELI5 (explain like I'm 5 years old) because I know nothing about this.</p>
  
  <pre><code>{
    "Version": "2012-10-17",
    "Statement": [
      {
        "Effect": "Allow",
        "Action": [
          "ssm:GetParameters",
          "secretsmanager:GetSecretValue",
          "kms:Decrypt",
          "sts:AssumeRole"
        ],
        "Principal": {
          "Service": ["ecs-tasks.amazonaws.com"]
        }
      }
    ]
  }
  </code></pre>
  
Comments: CC BY-SA 4.0
Comments: 2019-12-30T21:07:35.387Z
Comments: What kind of "It doesn't work" do you experience?
Comments: MLu
Comments: CC BY-SA 4.0
Comments: 2019-12-30T21:12:44.510Z
Comments: @MLu This particular implementation gives me the error message (from Terraform): "Error: Error creating IAM Role ecs-default-task-execution-role: MalformedPolicyDocument: AssumeRole policy may only specify STS AssumeRole actions".  I've tried other options that have given me other error messages as well.
Comments: Ertai87
Tags: <amazon-web-services><aws-iam><fargate>
Title: AWS permissions for Fargate and SSM
UserDisplayName: Ertai87
ThreadText: # AWS permissions for Fargate and SSM
  
  (Asked by: username_0 on 2019-12-30)
  
  I'm trying to create some infrastructure for a service I am building on AWS using AWS Fargate. I'm using SSM as a value store for some of my application configuration, so I need both the regular permissions for Fargate as well as additional permissions for SSM. However, after banging my head against this particular wall for a while, I've come to the conclusion that I just don't understand AWS IAM in general or this problem in particular, so I'm here for help.
  
  The basis of my IAM code comes from [this tutorial](https://medium.com/@bradford_hamilton/deploying-containers-on-amazons-ecs-using-fargate-and-terraform-part-2-2e6f6a3a957f); the IAM code is actually not in that tutorial but rather in [this file](https://github.com/bradford-hamilton/terraform-ecs-fargate/blob/master/terraform/roles.tf) in the github repo linked to that tutorial. I presume I need to retain that STS permission for something although I'm not entirely sure what.
  
  I've converted the IAM code from the tutorial into a JSON document because I find JSON easier to work with than the Terraform native thing. Here's what I've come up with. It doesn't work. I would like to know why it doesn't work and how to fix it. Please ELI5 (explain like I'm 5 years old) because I know nothing about this.
  
  ```
  {
    "Version": "2012-10-17",
    "Statement": [
      {
        "Effect": "Allow",
        "Action": [
          "ssm:GetParameters",
          "secretsmanager:GetSecretValue",
          "kms:Decrypt",
          "sts:AssumeRole"
        ],
        "Principal": {
          "Service": ["ecs-tasks.amazonaws.com"]
        }
      }
    ]
  }
  
  ```
  
  **Tags:** amazon-web-services, aws-iam, fargate
  
  > **Comments:**
  > **username_1**: What kind of "It doesn't work" do you experience?  
  > **username_0**: @username_1 This particular implementation gives me the error message (from Terraform): "Error: Error creating IAM Role ecs-default-task-execution-role: MalformedPolicyDocument: AssumeRole policy may only specify STS AssumeRole actions".  I've tried other options that have given me other error messages as well.  
  
  ---
  
  ## 2 answers
  
  ### Answer by username_1 on 2019-12-30. Score: 1
  
  IAM Role for Fargate has **two policies**:
  
  1. The first one describes which service can assume the role and its permissions. In this case it will be the `ecs-tasks.amazonaws.com` service (= Fargate) that can call `sts:AssumeRole` to get all the permissions from this Role.
  2. When Fargate *assumes* the role it gets the permissions specified within, these are the SSM, KMS and SecretsManager permissions.
  
  If you are using CloudFormation you can do something like this:
  
  ```
    FargateRole:
      Type: AWS::IAM::Role
      Properties:
        AssumeRolePolicyDocument:
          # This says that Fargate can assume this role
          Version: '2012-10-17'
          Statement:
          - Action: sts:AssumeRole
            Effect: Allow
            Principal:
              Service: ecs-tasks.amazonaws.com
        Path: /
        Policies:
        - PolicyName: FargatePermissions
          PolicyDocument:
            # This says what permissions will 
            # the Fargate container receive
            Statement:
            - Action:
              - ssm:GetParameters
              - secretsmanager:GetSecretValue
              - kms:Decrypt
              Effect: Allow
              Resource: '*'
  
  ```
  
  If you are building the role manually in the console be sure to select in the first step that it's an *IAM Role* for *ECS Task*, that will create the equivalent of `AssumeRolePolicyDocument` from the above code snippet.
  
  [![IAM Role Configuration](https://i.sstatic.net/3NSJT.png)](https://i.sstatic.net/3NSJT.png)
  
  Then in the next step add the policy *without* the `sts:AssumeRole`:
  
  ```
  {
      "Version": "2012-10-17",
      "Statement": [
          {
              "Effect": "Allow",
              "Action": [
                  "secretsmanager:GetSecretValue",
                  "ssm:GetParameters",
                  "kms:Decrypt"
              ],
              "Resource": "*"
          }
      ]
  }
  
  ```
  
  That should create the IAM Role you need. Ideally you should also restrict the access only to specific resources instead of using `"Resource": "*"` but for start it's easier to just use the wildcard.
  
  Hope that helps :)
  
  > **Comments:**
  > **username_0**: As a wrinkle, I'm trying to build this infrastructure using Terraform, which means I can't use the console directly.  I can use the console to create the role once to see what it does, but then I need to translate it to Terraform somehow so I can maintain it.  Is there an easy way to do this?  
  
  ---
  
  ### Answer by username_0 on 2019-12-31. Score: 0
  
  The answer was that my IAM configuration did not include a Task Role, only a Task Execution Role. I needed to add a Task Role which included the permissions I needed to access SSM, and then it worked.
  
  
  ---
  
  