aws iam role succesfully created but unvailable

Question

I am trying to create an IAM ecsInstanceRole for an ECS cluster with container instances. I am hitting a brick wall as follows:

• I created a IAM role named ecsInstanceRole.

• The trust relationship is:

  {
  
    "Version": "2008-10-17",
  
    "Statement": [
  
        {
  
            "Sid": "",
  
            "Effect": "Allow",
  
            "Principal": {
  
                "Service": "ec2.amazonaws.com"
  
            },
  
            "Action": "sts:AssumeRole"
  
        }
  
    ]
  
  }
  

• The attached policy is the AWS managed AmazonEC2ContainerServiceforEC2Role.

I think that everything was done by the book. Yet, when I try to attach the IAM role in the Create Cluster, the above role does not appear as an option. Same happens when i just try to create a simple EC2 instance. Role does not appear. Should I not be able to see the role since the trusted entity is ec2.amazonaws.com.

Please help. This is really driving me nuts.

Thanks.

Theodoros

Answer 1

you have created iam role for EC2 instance rather than for ECS service and hence you are not able to lookup the role while creating the ECS cluster.

you need to create role for ECS service & choose "EC2 Role for Elastic Container Service", that will have following in-line policy which provides required permissions to EC2 instances in ECS to access ECS

{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeTags", "ecs:CreateCluster", "ecs:DeregisterContainerInstance", "ecs:DiscoverPollEndpoint", "ecs:Poll", "ecs:RegisterContainerInstance", "ecs:StartTelemetrySession", "ecs:UpdateContainerInstancesState", "ecs:Submit*", "ecr:GetAuthorizationToken", "ecr:BatchCheckLayerAvailability", "ecr:GetDownloadUrlForLayer", "ecr:BatchGetImage", "logs:CreateLogStream", "logs:PutLogEvents" ], "Resource": "*" } ] }

After that you need to add the trust relationship for the above role as mentioned in the following documentation. https://docs.amazonaws.cn/en_us/AmazonECS/latest/developerguide/instance_IAM_role.html