Answers: <p>According to <a href="https://docs.aws.amazon.com/AmazonECS/latest/APIReference/CommonErrors.html" rel="nofollow noreferrer">https://docs.aws.amazon.com/AmazonECS/latest/APIReference/CommonErrors.html</a></p>
  <p>AccessDeniedException
  You do not have sufficient access to perform this action.</p>
  <p>that means that is is your role (or the role which Cloudformation is running under) which does not have the permissions. You can go to Cloudtrail and look up your request and there will be more details (which exact action did fail with which parameters). You should be able to figure out what is missing. Sometimes it is about some failing conditions. E.g. if your environment enforces resources to have particular tags. Would be good if you can update the question with the cloudtrail output.</p>
  
Answers: CC BY-SA 4.0
Answers: 2023-12-21T11:32:26.297Z
Answers: 2023-12-21T11:32:26.297Z
Answers: petrchpetr
Body: <p>I am trying to create an ECS service in a cloud formation json. Here is the role I created (I know that it has additional permissions, I am using one role for now and will break them up later)</p>
  <pre><code> &quot;LambdaBrownlowRole&quot;: {
        &quot;Type&quot;: &quot;AWS::IAM::Role&quot;,
        &quot;Properties&quot;: {
          &quot;RoleName&quot;: &quot;LambdaBrownlowRole&quot;,
          &quot;AssumeRolePolicyDocument&quot;: {
            &quot;Version&quot;: &quot;2012-10-17&quot;,
            &quot;Statement&quot;: [
              {
                &quot;Effect&quot;: &quot;Allow&quot;,
                &quot;Principal&quot;: {
                  &quot;Service&quot;: [
                    &quot;lambda.amazonaws.com&quot;,
                    &quot;events.amazonaws.com&quot;,
                    &quot;ecs-tasks.amazonaws.com&quot;,
                    &quot;ecs.amazonaws.com&quot;
                  ]
                },
                &quot;Action&quot;: &quot;sts:AssumeRole&quot;
              }
            ]
          },
          &quot;Policies&quot;: [
            {
              &quot;PolicyName&quot;: &quot;LambdaBrownlowPolicy&quot;,
              &quot;PolicyDocument&quot;: {
                &quot;Version&quot;: &quot;2012-10-17&quot;,
                &quot;Statement&quot;: [
                  {
                    &quot;Effect&quot;: &quot;Allow&quot;,
                    &quot;Action&quot;: [
                      &quot;s3:GetObject&quot;,
                      &quot;s3:PutObject&quot;,
                      &quot;s3:ListBucket&quot;,
                      &quot;s3:DeleteObject&quot;
                    ],
                    &quot;Resource&quot;: [
                      &quot;arn:aws:s3:::afl-game-data/*&quot;,
                      &quot;arn:aws:s3:::afl-game-data&quot;
                    ]
                  },
                  {
                    &quot;Effect&quot;: &quot;Allow&quot;,
                    &quot;Action&quot;: [
                      &quot;dynamodb:PutItem&quot;,
                      &quot;dynamodb:GetItem&quot;,
                      &quot;dynamodb:Query&quot;,
                      &quot;dynamodb:UpdateItem&quot;,
                      &quot;dynamodb:Scan&quot;,
                      &quot;dynamodb:BatchWriteItem&quot;,
                      &quot;dynamodb:BatchGetItem&quot;
                    ],
                    &quot;Resource&quot;: &quot;*&quot;
                  },
                  {
                    &quot;Effect&quot;: &quot;Allow&quot;,
                    &quot;Action&quot;: [
                      &quot;logs:CreateLogGroup&quot;,
                      &quot;logs:CreateLogStream&quot;,
                      &quot;logs:PutLogEvents&quot;,
                      &quot;logs:DescribeLogStreams&quot;
                    ],
                    &quot;Resource&quot;: &quot;*&quot;
                  },
                  {
                    &quot;Effect&quot;: &quot;Allow&quot;,
                    &quot;Action&quot;: [
                      &quot;ecs:CreateService&quot;,
                      &quot;ecs:DescribeServices&quot;,
                      &quot;ecs:UpdateService&quot;
                    ],
                    &quot;Resource&quot;: &quot;*&quot;
                  }
                ]
              }
            }
          ]
        }
      },
  </code></pre>
  <p>Here is the json snippet for the resources in question.</p>
  <pre><code> &quot;ECSBrownlowTaskDefinition&quot;: {
        &quot;Type&quot;: &quot;AWS::ECS::TaskDefinition&quot;,
        &quot;Properties&quot;: {
          &quot;Family&quot;: &quot;afl-brownlow-scrape&quot;,
          &quot;ExecutionRoleArn&quot;: {
            &quot;Fn::GetAtt&quot;: [
              &quot;LambdaBrownlowRole&quot;,
              &quot;Arn&quot;
            ]
          },
          &quot;Memory&quot;: &quot;512&quot;,
          &quot;Cpu&quot;: &quot;256&quot;,
          &quot;TaskRoleArn&quot;: {
            &quot;Fn::GetAtt&quot;: [
              &quot;LambdaBrownlowRole&quot;,
              &quot;Arn&quot;
            ]
          },
          &quot;RequiresCompatibilities&quot;: [
            &quot;FARGATE&quot;
          ],
          &quot;NetworkMode&quot;: &quot;awsvpc&quot;,
          &quot;ContainerDefinitions&quot;: [
            {
              &quot;Name&quot;: &quot;BrownlowScrape&quot;,
              &quot;Image&quot;: {
                &quot;Ref&quot;: &quot;ECRRepositoryUriParameter&quot;
              },
              &quot;Essential&quot;: true,
              &quot;Environment&quot;: [
                {
                  &quot;Name&quot;: &quot;YEAR_TO_QUERY&quot;,
                  &quot;Value&quot;: {
                    &quot;Ref&quot;: &quot;YearToQueryParameter&quot;
                  }
                },
                {
                  &quot;Name&quot;: &quot;BUCKET_NAME&quot;,
                  &quot;Value&quot;: {
                    &quot;Ref&quot;: &quot;BucketNameParameter&quot;
                  }
                },
                {
                  &quot;Name&quot;: &quot;DATA_PATH&quot;,
                  &quot;Value&quot;: {
                    &quot;Ref&quot;: &quot;DataPathParameter&quot;
                  }
                }
              ],
              &quot;LogConfiguration&quot;: {
                &quot;LogDriver&quot;: &quot;awslogs&quot;,
                &quot;Options&quot;: {
                  &quot;awslogs-group&quot;: {
                    &quot;Ref&quot;: &quot;AFLScrapeLogGroup&quot;
                  },
                  &quot;awslogs-region&quot;: {
                    &quot;Ref&quot;: &quot;AWS::Region&quot;
                  },
                  &quot;awslogs-stream-prefix&quot;: &quot;ecs&quot;
                }
              }
            }
          ]
        }
      },
      &quot;AFLScrapeLogGroup&quot;: {
        &quot;Type&quot;: &quot;AWS::Logs::LogGroup&quot;,
        &quot;Properties&quot;: {
          &quot;LogGroupName&quot;: &quot;/ecs/afl-brownlow-scrape&quot;
        }
      },
      &quot;ECSServiceScrapeAFL&quot;: {
        &quot;Type&quot;: &quot;AWS::ECS::Service&quot;,
        &quot;Properties&quot;: {
          &quot;Cluster&quot;: &quot;afl-brownlow-cluster&quot;,
          &quot;ServiceName&quot;: &quot;ServiceECSBrownlow&quot;,
          &quot;TaskDefinition&quot;: {
            &quot;Ref&quot;: &quot;ECSBrownlowTaskDefinition&quot;
          },
          &quot;LaunchType&quot;: &quot;FARGATE&quot;,
          &quot;DesiredCount&quot;: 0,
          &quot;Role&quot;: {
            &quot;Fn::GetAtt&quot;: [&quot;LambdaBrownlowRole&quot;, &quot;Arn&quot;]
          }
        }
      },
      &quot;ECSScrapeScheduledRule&quot;: {
        &quot;Type&quot;: &quot;AWS::Events::Rule&quot;,
        &quot;Properties&quot;: {
          &quot;Name&quot;: &quot;ecs-brownlow-scrape-weekly&quot;,
          &quot;Description&quot;: &quot;Scheduled rule for ECS brownlow-scrape&quot;,
          &quot;RoleArn&quot;: {
            &quot;Fn::GetAtt&quot;: [
              &quot;LambdaExecutionRole&quot;,
              &quot;Arn&quot;
            ]
          },
          &quot;ScheduleExpression&quot;: &quot;cron(0/10 * ? * * *)&quot;,
          &quot;State&quot;: &quot;ENABLED&quot;,
          &quot;Targets&quot;: [
            {
              &quot;Arn&quot;: {
                &quot;Fn::GetAtt&quot;: [
                  &quot;ECSServiceScrapeAFL&quot;,
                  &quot;Arn&quot;
                ]
              },
              &quot;Id&quot;: &quot;ecs-brownlow-scrape&quot;,
              &quot;EcsParameters&quot;: {
                &quot;TaskDefinitionArn&quot;: {
                  &quot;Ref&quot;: &quot;ECSBrownlowTaskDefinition&quot;
                },
                &quot;TaskCount&quot;: 1,
                &quot;LaunchType&quot;: &quot;FARGATE&quot;
              }
            }
          ]
        }
      }
  </code></pre>
  <p>On the creation of ECSServiceScrapeAFL, I get the following error:</p>
  <p>Resource handler returned message: &quot;Invalid request provided: CreateService error: Access denied (Service: AmazonECS; Status Code: 400; Error Code: AccessDeniedException; Request ID: XXX; Proxy: null)&quot; (RequestToken: XXX, HandlerErrorCode: InvalidRequest).</p>
  <p>Does anyone know what I am missing?</p>
  
Tags: <amazon-web-services><amazon-ecs><aws-cloudformation>
Title: Permission Issue when creating an ECS Service with CloudFormation
UserDisplayName: Harry
ThreadText: # Permission Issue when creating an ECS Service with CloudFormation
  
  (Asked by: username_0 on 2023-12-21)
  
  I am trying to create an ECS service in a cloud formation json. Here is the role I created (I know that it has additional permissions, I am using one role for now and will break them up later)
  
  ```
   "LambdaBrownlowRole": {
        "Type": "AWS::IAM::Role",
        "Properties": {
          "RoleName": "LambdaBrownlowRole",
          "AssumeRolePolicyDocument": {
            "Version": "2012-10-17",
            "Statement": [
              {
                "Effect": "Allow",
                "Principal": {
                  "Service": [
                    "lambda.amazonaws.com",
                    "events.amazonaws.com",
                    "ecs-tasks.amazonaws.com",
                    "ecs.amazonaws.com"
                  ]
                },
                "Action": "sts:AssumeRole"
              }
            ]
          },
          "Policies": [
            {
              "PolicyName": "LambdaBrownlowPolicy",
              "PolicyDocument": {
                "Version": "2012-10-17",
                "Statement": [
                  {
                    "Effect": "Allow",
                    "Action": [
                      "s3:GetObject",
                      "s3:PutObject",
                      "s3:ListBucket",
                      "s3:DeleteObject"
                    ],
                    "Resource": [
                      "arn:aws:s3:::afl-game-data/*",
                      "arn:aws:s3:::afl-game-data"
                    ]
                  },
                  {
                    "Effect": "Allow",
                    "Action": [
                      "dynamodb:PutItem",
                      "dynamodb:GetItem",
                      "dynamodb:Query",
                      "dynamodb:UpdateItem",
                      "dynamodb:Scan",
                      "dynamodb:BatchWriteItem",
                      "dynamodb:BatchGetItem"
                    ],
                    "Resource": "*"
                  },
                  {
                    "Effect": "Allow",
                    "Action": [
                      "logs:CreateLogGroup",
                      "logs:CreateLogStream",
                      "logs:PutLogEvents",
                      "logs:DescribeLogStreams"
                    ],
                    "Resource": "*"
                  },
                  {
                    "Effect": "Allow",
                    "Action": [
                      "ecs:CreateService",
                      "ecs:DescribeServices",
                      "ecs:UpdateService"
                    ],
                    "Resource": "*"
                  }
                ]
              }
            }
          ]
        }
      },
  
  ```
  
  Here is the json snippet for the resources in question.
  
  ```
   "ECSBrownlowTaskDefinition": {
        "Type": "AWS::ECS::TaskDefinition",
        "Properties": {
          "Family": "afl-brownlow-scrape",
          "ExecutionRoleArn": {
            "Fn::GetAtt": [
              "LambdaBrownlowRole",
              "Arn"
            ]
          },
          "Memory": "512",
          "Cpu": "256",
          "TaskRoleArn": {
            "Fn::GetAtt": [
              "LambdaBrownlowRole",
              "Arn"
            ]
          },
          "RequiresCompatibilities": [
            "FARGATE"
          ],
          "NetworkMode": "awsvpc",
          "ContainerDefinitions": [
            {
              "Name": "BrownlowScrape",
              "Image": {
                "Ref": "ECRRepositoryUriParameter"
              },
              "Essential": true,
              "Environment": [
                {
                  "Name": "YEAR_TO_QUERY",
                  "Value": {
                    "Ref": "YearToQueryParameter"
                  }
                },
                {
                  "Name": "BUCKET_NAME",
                  "Value": {
                    "Ref": "BucketNameParameter"
                  }
                },
                {
                  "Name": "DATA_PATH",
                  "Value": {
                    "Ref": "DataPathParameter"
                  }
                }
              ],
              "LogConfiguration": {
                "LogDriver": "awslogs",
                "Options": {
                  "awslogs-group": {
                    "Ref": "AFLScrapeLogGroup"
                  },
                  "awslogs-region": {
                    "Ref": "AWS::Region"
                  },
                  "awslogs-stream-prefix": "ecs"
                }
              }
            }
          ]
        }
      },
      "AFLScrapeLogGroup": {
        "Type": "AWS::Logs::LogGroup",
        "Properties": {
          "LogGroupName": "/ecs/afl-brownlow-scrape"
        }
      },
      "ECSServiceScrapeAFL": {
        "Type": "AWS::ECS::Service",
        "Properties": {
          "Cluster": "afl-brownlow-cluster",
          "ServiceName": "ServiceECSBrownlow",
          "TaskDefinition": {
            "Ref": "ECSBrownlowTaskDefinition"
          },
          "LaunchType": "FARGATE",
          "DesiredCount": 0,
          "Role": {
            "Fn::GetAtt": ["LambdaBrownlowRole", "Arn"]
          }
        }
      },
      "ECSScrapeScheduledRule": {
        "Type": "AWS::Events::Rule",
        "Properties": {
          "Name": "ecs-brownlow-scrape-weekly",
          "Description": "Scheduled rule for ECS brownlow-scrape",
          "RoleArn": {
            "Fn::GetAtt": [
              "LambdaExecutionRole",
              "Arn"
            ]
          },
          "ScheduleExpression": "cron(0/10 * ? * * *)",
          "State": "ENABLED",
          "Targets": [
            {
              "Arn": {
                "Fn::GetAtt": [
                  "ECSServiceScrapeAFL",
                  "Arn"
                ]
              },
              "Id": "ecs-brownlow-scrape",
              "EcsParameters": {
                "TaskDefinitionArn": {
                  "Ref": "ECSBrownlowTaskDefinition"
                },
                "TaskCount": 1,
                "LaunchType": "FARGATE"
              }
            }
          ]
        }
      }
  
  ```
  
  On the creation of ECSServiceScrapeAFL, I get the following error:
  
  Resource handler returned message: "Invalid request provided: CreateService error: Access denied (Service: AmazonECS; Status Code: 400; Error Code: AccessDeniedException; Request ID: XXX; Proxy: null)" (RequestToken: XXX, HandlerErrorCode: InvalidRequest).
  
  Does anyone know what I am missing?
  
  **Tags:** amazon-web-services, amazon-ecs, aws-cloudformation
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2023-12-21. Score: 0
  
  According to <https://docs.aws.amazon.com/AmazonECS/latest/APIReference/CommonErrors.html>
  
  AccessDeniedException
  You do not have sufficient access to perform this action.
  
  that means that is is your role (or the role which Cloudformation is running under) which does not have the permissions. You can go to Cloudtrail and look up your request and there will be more details (which exact action did fail with which parameters). You should be able to figure out what is missing. Sometimes it is about some failing conditions. E.g. if your environment enforces resources to have particular tags. Would be good if you can update the question with the cloudtrail output.
  
  
  ---
  
  