如何为 ECS 任务分配 IAM 角色

Question

可以为 ECS 任务分配 IAM 角色，以便与 AWS API 进行通信，而无需将用户凭证传递给任务。 这适用于 AWS CLI 和 SDK。 here 有相当不错的文档，但我找不到涵盖所有细节的合适示例，我将创建一个自我回答问题，以免其他人感到痛苦。

Answer 1

我创建了一个Git repo with the full example。重要的一点是：

• 使用 AssumeRolePolicyDocument 创建 IAM 角色定义。
• 将 IAM 角色分配给任务。

• 使用 AWS JS 开发工具包。

  IAMRole:
  Type: AWS::IAM::Role
  Properties:
      RoleName: !Sub role-task-${AWS::StackName} # Doesn't matter too much but let's make it nice anyway
      Path: / # No idea about this one but / seems to work
      # This is the funky stuff.. don't try to understand just copy-paste. Source: http://docs.aws.amazon.com/AmazonECS/latest/developerguide/task_IAM_role.html
      AssumeRolePolicyDocument: |
          {
              "Statement": [{
                  "Effect": "Allow",
                  "Principal": { "Service": [ "ecs-tasks.amazonaws.com" ]},
                  "Action": [ "sts:AssumeRole" ]
              }]
          }
      Policies:
          - PolicyName: !Sub ecs-task-${AWS::StackName}
            # You can add any actions here you want your container to be allowed to execute.
            PolicyDocument:
              {
                  "Version": "2012-10-17",
                  "Statement": [{
                          "Effect": "Allow",
                          "Action": [
                              "cloudwatch:PutMetricData" # more actions if needed
                          ],
                          "Resource": "*"
                  }]
              }
  

AWS 开发工具包的初始化。 AWS 开发工具包将自动检测容器是否有权访问角色凭证并自行初始化。除了创建 API 对象之外，您无需进行任何初始化。

 var AWS = require('aws-sdk');

 var cw = new AWS.CloudWatch();
 var s3 = new AWS.S3();