How to use AWS ECS Task Role in Node AWS SDK code

Question

Code that uses the AWS Node SDK doesn't seem to be able to gain the role permissions of the ECS task.

If I run the code on an EC2 ECS instance, the code seems to inherit the role on the instance, not of the task.

If I run the code on Fargate, the code doesn't get any permission.

By contrast, any bash scripts that run within the instance seem to have the proper permissions.

Indeed, the documentation doesn't mention this as an option for the node sdk, just:

1. Loaded from IAM roles for Amazon EC2 (if running on EC2),
2. Loaded from the shared credentials file (~/.aws/credentials),
3. Loaded from environment variables,
4. Loaded from a JSON file on disk,
5. Hardcoded in your application

Is there any way to have your node code gain the permissions of the ECS task?

This seems to be the logical way to pass permissions to your code. It works beautifully with code running on an instance.

The only workaround I can think of is to create one IAM user per ECS service and pass the API Key/Secret as environmental variables in the task definition. However, that doesn't seem very secure since it would be visible in plain text to anyone with access to the task definition.

Answer 1

Your question is missing a lot of details on how you setup your ECS Cluster plus I am not sure if the question is for ECS or for Fargate specifically.

Make sure that you are using the latest version of the SDK. Javascript supports ECS and Fargate task credentials.

Often there is confusion about credentials on ECS. There is the IAM role that is assigned to the Cluster EC2 instances and the IAM role that is assigned to ECS tasks.

The most common problem is the "Trust Relationship" has not been setup on the ECS Task Role. Select your IAM role and then the "Trust Relationships" tab and make sure that it looks like this:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "",
      "Effect": "Allow",
      "Principal": {
        "Service": "ecs-tasks.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

In addition to the standard Amazon ECS permissions required to run tasks and services, IAM users also require iam:PassRole permissions to use IAM roles for tasks.

Next verify that you are using the IAM role in the task definition. Specify the correct IAM role ARN in the Task Role field. Note that this different than Task Execution Role (which allows containers to pull images and publish logs).

Next make sure that your ECS Instances are using the latest version of the ECS Agent. The agent version is listed on the "ECS Instances" tab under the right hand side column "Agent version". The current version is 1.20.3 .

Are you using an ECS optimized AMI? If not, add --net=host to your docker run command that starts the agent. Review this link for more information.

Answer 2

I figured it out. This was a weird one.

A colleague thought it would be "safer" if we call Object.freeze on proccess.env . This was somehow interfering with the SDK's ability to access the credentials.

Removed that "improvement" and all is fine again. I think the lesson is "do not mess with process.env ".