I am trying to create an ECS service in a cloud formation json. Here is the role I created (I know that it has additional permissions, I am using one role for now and will break them up later)
"LambdaBrownlowRole": {
"Type": "AWS::IAM::Role",
"Properties": {
"RoleName": "LambdaBrownlowRole",
"AssumeRolePolicyDocument": {
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": [
"lambda.amazonaws.com",
"events.amazonaws.com",
"ecs-tasks.amazonaws.com",
"ecs.amazonaws.com"
]
},
"Action": "sts:AssumeRole"
}
]
},
"Policies": [
{
"PolicyName": "LambdaBrownlowPolicy",
"PolicyDocument": {
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"s3:GetObject",
"s3:PutObject",
"s3:ListBucket",
"s3:DeleteObject"
],
"Resource": [
"arn:aws:s3:::afl-game-data/*",
"arn:aws:s3:::afl-game-data"
]
},
{
"Effect": "Allow",
"Action": [
"dynamodb:PutItem",
"dynamodb:GetItem",
"dynamodb:Query",
"dynamodb:UpdateItem",
"dynamodb:Scan",
"dynamodb:BatchWriteItem",
"dynamodb:BatchGetItem"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"logs:CreateLogGroup",
"logs:CreateLogStream",
"logs:PutLogEvents",
"logs:DescribeLogStreams"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"ecs:CreateService",
"ecs:DescribeServices",
"ecs:UpdateService"
],
"Resource": "*"
}
]
}
}
]
}
},
Here is the json snippet for the resources in question.
"ECSBrownlowTaskDefinition": {
"Type": "AWS::ECS::TaskDefinition",
"Properties": {
"Family": "afl-brownlow-scrape",
"ExecutionRoleArn": {
"Fn::GetAtt": [
"LambdaBrownlowRole",
"Arn"
]
},
"Memory": "512",
"Cpu": "256",
"TaskRoleArn": {
"Fn::GetAtt": [
"LambdaBrownlowRole",
"Arn"
]
},
"RequiresCompatibilities": [
"FARGATE"
],
"NetworkMode": "awsvpc",
"ContainerDefinitions": [
{
"Name": "BrownlowScrape",
"Image": {
"Ref": "ECRRepositoryUriParameter"
},
"Essential": true,
"Environment": [
{
"Name": "YEAR_TO_QUERY",
"Value": {
"Ref": "YearToQueryParameter"
}
},
{
"Name": "BUCKET_NAME",
"Value": {
"Ref": "BucketNameParameter"
}
},
{
"Name": "DATA_PATH",
"Value": {
"Ref": "DataPathParameter"
}
}
],
"LogConfiguration": {
"LogDriver": "awslogs",
"Options": {
"awslogs-group": {
"Ref": "AFLScrapeLogGroup"
},
"awslogs-region": {
"Ref": "AWS::Region"
},
"awslogs-stream-prefix": "ecs"
}
}
}
]
}
},
"AFLScrapeLogGroup": {
"Type": "AWS::Logs::LogGroup",
"Properties": {
"LogGroupName": "/ecs/afl-brownlow-scrape"
}
},
"ECSServiceScrapeAFL": {
"Type": "AWS::ECS::Service",
"Properties": {
"Cluster": "afl-brownlow-cluster",
"ServiceName": "ServiceECSBrownlow",
"TaskDefinition": {
"Ref": "ECSBrownlowTaskDefinition"
},
"LaunchType": "FARGATE",
"DesiredCount": 0,
"Role": {
"Fn::GetAtt": ["LambdaBrownlowRole", "Arn"]
}
}
},
"ECSScrapeScheduledRule": {
"Type": "AWS::Events::Rule",
"Properties": {
"Name": "ecs-brownlow-scrape-weekly",
"Description": "Scheduled rule for ECS brownlow-scrape",
"RoleArn": {
"Fn::GetAtt": [
"LambdaExecutionRole",
"Arn"
]
},
"ScheduleExpression": "cron(0/10 * ? * * *)",
"State": "ENABLED",
"Targets": [
{
"Arn": {
"Fn::GetAtt": [
"ECSServiceScrapeAFL",
"Arn"
]
},
"Id": "ecs-brownlow-scrape",
"EcsParameters": {
"TaskDefinitionArn": {
"Ref": "ECSBrownlowTaskDefinition"
},
"TaskCount": 1,
"LaunchType": "FARGATE"
}
}
]
}
}
On the creation of ECSServiceScrapeAFL, I get the following error:
Resource handler returned message: "Invalid request provided: CreateService error: Access denied (Service: AmazonECS; Status Code: 400; Error Code: AccessDeniedException; Request ID: XXX; Proxy: null)" (RequestToken: XXX, HandlerErrorCode: InvalidRequest).
Does anyone know what I am missing?
