IAM Roles Overview

Three-Role Model

ECS Express Mode requires three distinct IAM roles, each with a specific trust relationship and purpose. This separation follows the principle of least privilege — each role grants only the permissions needed for its specific function.

The Task Execution Role Task Execution Role
An IAM role assumed by ecs-tasks.amazonaws.com that grants ECS permissions to pull container images and write CloudWatch logs. handles container lifecycle operations, the Infrastructure Role Infrastructure Role
An IAM role assumed by ecs.amazonaws.com that grants ECS Express Mode permissions to provision ALB, networking, and auto scaling resources. grants ECS permission to provision and manage load balancing and scaling resources, and the Task Role Task Role
An IAM role assumed by ecs-tasks.amazonaws.com that grants the running container application-level permissions (Bedrock access in this project). provides application-level permissions to the running container.

Note

All three roles use aws:SourceAccount conditions in their trust policies to prevent cross-account confused deputy attacks.

Role Name	Trusted Principal	Purpose
Task Execution Role Task Execution Role An IAM role assumed by ecs-tasks.amazonaws.com that grants ECS permissions to pull container images and write CloudWatch logs.	ecs-tasks.amazonaws.com	Pulls container images from ECR and writes logs to CloudWatch
Infrastructure Role Infrastructure Role An IAM role assumed by ecs.amazonaws.com that grants ECS Express Mode permissions to provision ALB, networking, and auto scaling resources.	ecs.amazonaws.com	Provisions and manages ALB, networking, and auto scaling resources for Express Mode
Task Role Task Role An IAM role assumed by ecs-tasks.amazonaws.com that grants the running container application-level permissions (Bedrock access in this project).	ecs-tasks.amazonaws.com	Grants the running container application-level permissions (Bedrock access in this project)

Trust Relationships

Each role has an assume-role policy that restricts which AWS service principal can use it. Two principals are involved:

• ecs-tasks.amazonaws.com — assumed by the ECS task agent for both the Task Execution Role Task Execution Role
  An IAM role assumed by ecs-tasks.amazonaws.com that grants ECS permissions to pull container images and write CloudWatch logs. (container lifecycle) and the Task Role Task Role
  An IAM role assumed by ecs-tasks.amazonaws.com that grants the running container application-level permissions (Bedrock access in this project). (application permissions)
• ecs.amazonaws.com — assumed by the ECS control plane for the Infrastructure Role Infrastructure Role
  An IAM role assumed by ecs.amazonaws.com that grants ECS Express Mode permissions to provision ALB, networking, and auto scaling resources. (provisioning Express Mode resources)

Tip

The Infrastructure Role is unique to Express Mode. Classic ECS services do not require it because you provision ALB and scaling resources directly in your Terraform code.

Next Steps

Each role is documented in detail on its own page with full HCL from the source repository:

• Task Execution Role Task Execution Role
  An IAM role assumed by ecs-tasks.amazonaws.com that grants ECS permissions to pull container images and write CloudWatch logs. — image pulls and logging
• Infrastructure Role Infrastructure Role
  An IAM role assumed by ecs.amazonaws.com that grants ECS Express Mode permissions to provision ALB, networking, and auto scaling resources. — Express Mode resource provisioning
• Task Role Task Role
  An IAM role assumed by ecs-tasks.amazonaws.com that grants the running container application-level permissions (Bedrock access in this project). (Bedrock) — application permissions