Actions, resources, and condition keys for Amazon Elastic Container Service - Service Authorization Reference

Actions, resources, and condition keys for Amazon Elastic Container Service

Amazon Elastic Container Service (service prefix: ecs) provides the following service-specific resources, actions, and condition context keys for use in IAM permission policies.

References:

Actions defined by Amazon Elastic Container Service

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

The Resource types column indicates whether each action supports resource-level permissions. If there is no value for this column, you must specify all resources ("*") in the Resource element of your policy statement. If the column includes a resource type, then you can specify an ARN of that type in a statement with that action. Required resources are indicated in the table with an asterisk (*). If you specify a resource-level permission ARN in a statement using this action, then it must be of this type. Some actions support multiple resource types. If the resource type is optional (not indicated as required), then you can choose to use one but not the other.

For details about the columns in the following table, see The actions table.

Actions Description Access level Resource types (*required) Condition keys Dependent actions
CreateCapacityProvider Grants permission to create a new capacity provider. Capacity providers are associated with an Amazon ECS cluster and are used in capacity provider strategies to facilitate cluster auto scaling Write

aws:RequestTag/${TagKey}

aws:TagKeys

CreateCluster Grants permission to create a new Amazon ECS cluster Write

ecs:capacity-provider

aws:RequestTag/${TagKey}

aws:TagKeys

CreateService Grants permission to run and maintain a desired number of tasks from a specified task definition via service creation Write

service*

ecs:cluster

ecs:capacity-provider

ecs:task-definition

ecs:enable-execute-command

aws:RequestTag/${TagKey}

aws:TagKeys

CreateTaskSet Grants permission to create a new Amazon ECS task set Write

ecs:cluster

ecs:capacity-provider

ecs:service

ecs:task-definition

DeleteAccountSetting Grants permission to modify the ARN and resource ID format of a resource for a specified IAM user, IAM role, or the root user for an account. You can specify whether the new ARN and resource ID format are disabled for new resources that are created Write
DeleteAttributes Grants permission to delete one or more custom attributes from an Amazon ECS resource Write

container-instance*

ecs:cluster

DeleteCapacityProvider Grants permission to delete the specified capacity provider Write

capacity-provider*

DeleteCluster Grants permission to delete the specified cluster Write

cluster*

DeleteService Grants permission to delete a specified service within a cluster Write

service*

ecs:cluster

DeleteTaskSet Grants permission to delete the specified task set Write

task-set*

ecs:cluster

ecs:service

DeregisterContainerInstance Grants permission to deregister an Amazon ECS container instance from the specified cluster Write

cluster*

DeregisterTaskDefinition Grants permission to deregister the specified task definition by family and revision Write
DescribeCapacityProviders Grants permission to describe one or more Amazon ECS capacity providers Read

capacity-provider*

DescribeClusters Grants permission to describes one or more of your clusters Read

cluster*

DescribeContainerInstances Grants permission to describes Amazon ECS container instances Read

container-instance*

ecs:cluster

DescribeServices Grants permission to describe the specified services running in your cluster Read

service*

ecs:cluster

DescribeTaskDefinition Grants permission to describe a task definition. You can specify a family and revision to find information about a specific task definition, or you can simply specify the family to find the latest ACTIVE revision in that family Read
DescribeTaskSets Grants permission to describe Amazon ECS task sets Read

task-set*

ecs:cluster

ecs:service

DescribeTasks Grants permission to describe a specified task or tasks Read

task*

ecs:cluster

DiscoverPollEndpoint Grants permission to get an endpoint for the Amazon ECS agent to poll for updates Write
ExecuteCommand Grants permission to run a command remotely on an Amazon ECS container Write

cluster

task

ecs:cluster

ecs:container-name

ecs:task

ListAccountSettings Grants permission to list the account settings for an Amazon ECS resource for a specified principal Read
ListAttributes Grants permission to lists the attributes for Amazon ECS resources within a specified target type and cluster List

cluster*

ListClusters Grants permission to get a list of existing clusters List
ListContainerInstances Grants permission to get a list of container instances in a specified cluster List

cluster*

ListServices Grants permission to get a list of services that are running in a specified cluster List

ecs:cluster

ListTagsForResource Grants permission to get a list of tags for the specified resource Read

cluster

container-instance

task

task-definition

ListTaskDefinitionFamilies Grants permission to get a list of task definition families that are registered to your account (which may include task definition families that no longer have any ACTIVE task definitions) List
ListTaskDefinitions Grants permission to get a list of task definitions that are registered to your account List
ListTasks Grants permission to get a list of tasks for a specified cluster List

container-instance*

ecs:cluster

Poll [permission only] Grants permission to an agent to connect with the Amazon ECS service to report status and get commands Write

container-instance*

ecs:cluster

PutAccountSetting Grants permission to modify the ARN and resource ID format of a resource for a specified IAM user, IAM role, or the root user for an account. You can specify whether the new ARN and resource ID format are enabled for new resources that are created. Enabling this setting is required to use new Amazon ECS features such as resource tagging Write
PutAccountSettingDefault Grants permission to modify the ARN and resource ID format of a resource type for all IAM users on an account for which no individual account setting has been set. Enabling this setting is required to use new Amazon ECS features such as resource tagging Write
PutAttributes Grants permission to create or update an attribute on an Amazon ECS resource Write

container-instance*

ecs:cluster

PutClusterCapacityProviders Grants permission to modify the available capacity providers and the default capacity provider strategy for a cluster Write

capacity-provider*

ecs:capacity-provider

RegisterContainerInstance Grants permission to register an EC2 instance into the specified cluster Write

cluster*

aws:RequestTag/${TagKey}

aws:TagKeys

RegisterTaskDefinition Grants permission to register a new task definition from the supplied family and containerDefinitions Write

aws:RequestTag/${TagKey}

aws:TagKeys

RunTask Grants permission to start a task using random placement and the default Amazon ECS scheduler Write

task-definition*

ecs:cluster

ecs:capacity-provider

ecs:enable-execute-command

aws:RequestTag/${TagKey}

aws:TagKeys

StartTask Grants permission to start a new task from the specified task definition on the specified container instance or instances Write

task-definition*

ecs:cluster

ecs:container-instances

ecs:enable-execute-command

aws:RequestTag/${TagKey}

aws:TagKeys

StartTelemetrySession Grants permission to start a telemetry session Write

container-instance*

ecs:cluster

StopTask Grants permission to stop a running task Write

task*

ecs:cluster

SubmitAttachmentStateChanges Grants permission to send an acknowledgement that attachments changed states Write

cluster*

SubmitContainerStateChange Grants permission to send an acknowledgement that a container changed states Write

cluster*

SubmitTaskStateChange Grants permission to send an acknowledgement that a task changed states Write

cluster*

TagResource Grants permission to tag the specified resource Tagging

cluster

container-instance

service

task

task-definition

aws:TagKeys

aws:RequestTag/${TagKey}

UntagResource Grants permission to untag the specified resource Tagging

cluster

container-instance

service

task

task-definition

aws:TagKeys

UpdateCapacityProvider Grants permission to update the specified capacity provider Write

capacity-provider*

UpdateCluster Grants permission to modify the configuration or settings to use for a cluster Write

cluster*

UpdateClusterSettings Grants permission to modify the settings to use for a cluster Write

cluster*

UpdateContainerAgent Grants permission to update the Amazon ECS container agent on a specified container instance Write

container-instance*

ecs:cluster

UpdateContainerInstancesState Grants permission to the user to modify the status of an Amazon ECS container instance Write

container-instance*

ecs:cluster

UpdateService Grants permission to modify the parameters of a service Write

service*

ecs:cluster

ecs:capacity-provider

ecs:enable-execute-command

ecs:task-definition

UpdateServicePrimaryTaskSet Grants permission to modify the primary task set used in a service Write

service*

ecs:cluster

UpdateTaskSet Grants permission to update the specified task set Write

task-set*

ecs:cluster

ecs:service

Resource types defined by Amazon Elastic Container Service

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements. Each action in the Actions table identifies the resource types that can be specified with that action. A resource type can also define which condition keys you can include in a policy. These keys are displayed in the last column of the table. For details about the columns in the following table, see The resource types table.

Resource types ARN Condition keys
cluster arn:${Partition}:ecs:${Region}:${Account}:cluster/${ClusterName}

aws:ResourceTag/${TagKey}

ecs:ResourceTag/${TagKey}

container-instance arn:${Partition}:ecs:${Region}:${Account}:container-instance/${ContainerInstanceId}

aws:ResourceTag/${TagKey}

ecs:ResourceTag/${TagKey}

service arn:${Partition}:ecs:${Region}:${Account}:service/${ServiceName}

aws:ResourceTag/${TagKey}

ecs:ResourceTag/${TagKey}

task arn:${Partition}:ecs:${Region}:${Account}:task/${TaskId}

aws:ResourceTag/${TagKey}

ecs:ResourceTag/${TagKey}

task-definition arn:${Partition}:ecs:${Region}:${Account}:task-definition/${TaskDefinitionFamilyName}:${TaskDefinitionRevisionNumber}

aws:ResourceTag/${TagKey}

ecs:ResourceTag/${TagKey}

capacity-provider arn:${Partition}:ecs:${Region}:${Account}:capacity-provider/${CapacityProviderName}

aws:ResourceTag/${TagKey}

ecs:ResourceTag/${TagKey}

task-set arn:${Partition}:ecs:${region}:${Account}:task-set/${ClusterName}/${ServiceName}/${TaskSetId}

aws:ResourceTag/${TagKey}

ecs:ResourceTag/${TagKey}

Condition keys for Amazon Elastic Container Service

Amazon Elastic Container Service defines the following condition keys that can be used in the Condition element of an IAM policy. You can use these keys to further refine the conditions under which the policy statement applies. For details about the columns in the following table, see The condition keys table.

To view the global condition keys that are available to all services, see Available global condition keys.

Condition keys Description Type
aws:RequestTag/${TagKey} Filters access by the tags that are passed in the request String
aws:ResourceTag/${TagKey} Filters access based on tag key-value pairs attached to the resource String
aws:TagKeys Filters access based on tag keys that are passed in the request String
ecs:ResourceTag/${TagKey} Filters access based on tag key-value pairs attached to the resource String
ecs:capacity-provider Filters access based on the ARN of an Amazon ECS capacity provider ARN
ecs:cluster Filters access based on the ARN of an Amazon ECS cluster ARN
ecs:container-instances Filters access based on the ARN of an Amazon ECS container instance ARN
ecs:container-name Filters access based on the name of an Amazon ECS container which is defined in the ECS task definition String
ecs:enable-execute-command Filters access based on execute-command capability of your Amazon ECS task or Amazon ECS service String
ecs:service Filters access based on the ARN of an Amazon ECS service ARN
ecs:task Filters access based on the ARN of an Amazon ECS task ARN
ecs:task-definition Filters access based on the ARN of an Amazon ECS task definition ARN