Infrastructure Role

Overview

The Infrastructure Role Infrastructure Role
An IAM role assumed by ecs.amazonaws.com that grants ECS Express Mode permissions to provision ALB, networking, and auto scaling resources. is assumed by the ECS service principal (ecs.amazonaws.com) and grants Express Mode permissions to provision and manage ALB, networking, and auto scaling resources on your behalf.

This role is referenced in the infrastructure_role_arn argument of the Express Gateway Service Express Gateway Service
The aws_ecs_express_gateway_service Terraform resource that provisions an ECS service with managed ALB, auto scaling, and simplified configuration for HTTP/HTTPS web applications and APIs. resource. Without it, ECS cannot create or manage the shared load balancer and related infrastructure.

Note

The infrastructure_role_arn is an immutable-at-create field. Changing it requires replacing the entire Express Gateway Service.

Terraform Configuration

The following HCL defines the Infrastructure Role Infrastructure Role
An IAM role assumed by ecs.amazonaws.com that grants ECS Express Mode permissions to provision ALB, networking, and auto scaling resources. with the AWS-managed policy for Express Gateway Services and a trust policy scoped to your account using the aws:SourceAccount condition.

main.tf

resource "aws_iam_role" "ecs_infrastructure" {
  name = "${var.name}-ecs-infrastructure"

  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Effect = "Allow"
        Principal = {
          Service = "ecs.amazonaws.com"
        }
        Action = "sts:AssumeRole"
        Condition = {
          StringEquals = {
            "aws:SourceAccount" = data.aws_caller_identity.current.account_id
          }
        }
      }
    ]
  })
}

resource "aws_iam_role_policy_attachment" "ecs_infrastructure" {
  role       = aws_iam_role.ecs_infrastructure.name
  policy_arn = "arn:aws:iam::aws:policy/AmazonECSInfrastructureRoleforExpressGatewayServices"
}

Trust Policy

The trust policy allows only the ecs.amazonaws.com service principal to assume this role. The aws:SourceAccount condition restricts assumption to requests originating from your specific AWS account, preventing cross-account confused deputy scenarios.

Element	Value	Purpose
Principal	ecs.amazonaws.com	ECS service assumes the role to manage infrastructure
Action	sts:AssumeRole	Allows the principal to obtain temporary credentials
Condition	aws:SourceAccount	Restricts to your account ID only

Managed Policy

The AmazonECSInfrastructureRoleforExpressGatewayServices AWS-managed policy grants permissions for ECS to provision and manage the Shared ALB Shared ALB
The Application Load Balancer shared by up to 25 Express services in the same VPC using Host header routing rules. , target groups, listeners, auto scaling policies, and networking resources required by Express Mode services.

Tip

Using the AWS-managed policy ensures your role stays up to date as Express Mode adds new capabilities without requiring manual policy updates.