AWS ECS Task Execution Role vs Task Role

As an Infrastructure DevOps Engineer, I have had the opportunity to work with a variety of container orchestration platforms, including AWS Elastic Container Service (ECS). Last year, while working for one of my clients, I learned about the difference between the task execution role and the task role in ECS.

In ECS, there are two types of roles that can be associated with a task: the task execution role and the task role. The task execution role is an IAM role that is associated with the ECS task itself. It allows the task to access other AWS services, such as Amazon Simple Storage Service (S3) or Amazon DynamoDB. The task execution role is required for tasks that need to access other AWS services, and it is specified when the task is created. You can learn more about the task execution role in the AWS documentation.

On the other hand, the task role is an IAM role that is associated with the Amazon Elastic Container Service (ECS) task definition. It is used to pass the IAM role credentials to the container as environment variables, and it allows the container to make calls to AWS APIs. The task role is optional, and it is specified in the task definition. You can learn more about the task role in the AWS documentation.

It is important to maintain both the task execution role and the task role correctly in ECS, as they both play a critical role in the security and functionality of your tasks. For example, if you want to allow your ECS tasks to retrieve secrets from the SSM parameter store, you could create an IAM policy like the following:

{
  "Version": "2012-10-17",
  " Statement": [
    {
      "Effect": "Allow",
      "Action": "ssm:GetParameter",
      "Resource": "arn:aws:ssm:REGION:ACCOUNT_ID:parameter/service/myservice/SECRET"
    }
  ]
}

This policy allows the ECS task to retrieve the secret stored in the SSM parameter store at the path service/myservice/SECRET.

If we add this policy only to the task execution role. We can allow the ECS task to retrieve the SSM secret using reference, and use it (e.g. on application init phase). But, the container (application) will not be allowed to retrieve it programmatically from AWS API anymore.

If we add this policy to the task role. We’ll not be able to use it as a reference in the task definition. But, we’ll be able to retrieve it using provided AWS credentials from the container.

In conclusion, understanding the difference between the task execution role and the task role in ECS is important for maintaining the security and functionality of your tasks. The task execution role allows the task to access other AWS services, while the task role allows the container to make calls to AWS APIs. By carefully managing these roles and granting them only the necessary permissions, you can ensure that your tasks run smoothly and securely.