Step 函数无法触发 Fargate 集群上的 ECS 任务，权限问题

Question

我正在我的 ECS fargate 集群上创建并运行任务。

任务定义（带有角色）和 Fargate 集群已创建。

当我在步骤函数中使用运行任务步骤时，出现以下错误，

{
  "Error": "ECS.AccessDeniedException",
  "Cause": "User: arn:aws:sts::xxxxxxxxxx:assumed-role/StepFunctions-my-state-machine-role-xxxxxxxxxx/xxxxxxxxxx is not authorized to perform: iam:PassRole on resource: arn:aws:iam::xxxxxxxxxx:role/my-app-dev-exec because no identity-based policy allows the iam:PassRole action (Service: AmazonECS; Status Code: 400; Error Code: AccessDeniedException; Request ID: xxxxxxxxxx-xxxxxxxxxx-xxxxxxxxxx; Proxy: null)"
}

附加到步骤函数的角色具有以下策略（根据 AWS 提供的文档https://docs.aws.amazon.com/step-functions/latest/dg/ecs-iam.html）

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ecs:RunTask"
            ],
            "Resource": [
                "arn:aws:ecs:eu-west-1:xxxxxxxxxx:task-definition/*:*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "ecs:StopTask",
                "ecs:DescribeTasks"
            ],
            "Resource": [
                "arn:aws:ecs:eu-west-1:xxxxxxxxxx:task/*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "events:PutTargets",
                "events:PutRule",
                "events:DescribeRule"
            ],
            "Resource": [
                "arn:aws:events:eu-west-1:xxxxxxxxxx:rule/StepFunctionsGetEventsForECSTaskRule"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "states:DescribeStateMachine",
                "states:StartExecution",
                "states:ListExecutions",
                "states:UpdateStateMachine"
            ],
            "Resource": [
                "arn:aws:states:eu-west-1:xxxxxxxxxx:stateMachine:my-state-machine"
            ]
        }
    ]
}

与以下可信实体

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "states.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    },
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "events.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

有人可以帮助我解决上述权限问题需要授予什么额外权限吗？从错误中，我无法弄清楚需要什么额外的权限。

如果我将AmazonECS_FullAccess（aws 管理的）策略附加到该角色，则工作将完美运行。

Answer 1

由于您的任务将使用 IAM 角色，因此您需要指定附加权限“PassRole”。

最佳实践是限制可以传递哪些角色。因此建议添加一个条件限制，仅允许将角色传递给 ECS 任务。

尝试将此声明添加到您的策略中：

  {
        "Action": "iam:PassRole",
        "Effect": "Allow",
        "Resource": [
            "*"
        ],
        "Condition": {
            "StringLike": {
                "iam:PassedToService": "ecs-tasks.amazonaws.com"
            }
        }
    }