如何为同一ECS Task的两个Sidecar容器分配不同IAM角色？

是否可行？ #

完全可行。AWS ECS支持容器级IAM角色（Container-level IAM Roles），专门适配Sidecar这类多容器任务场景，允许为每个容器分配匹配其权限需求的独立IAM角色，完美契合最小权限原则。

核心实现逻辑 #

• 区别于传统的任务级IAM角色（Task Role）（所有容器共享权限），容器级IAM角色可在任务定义的容器配置中单独指定。
• 每个容器的IAM角色需要信任ecs-tasks.amazonaws.com服务主体，权限策略按需配置（比如一个容器配置S3+SQS访问权限，另一个可配置空策略或不指定角色）。
• 任务执行角色（Execution Role）需要具备iam:PassRole权限，允许ECS服务将容器级IAM角色传递给对应的容器。

Terraform 配置示例 #

1. 定义任务执行角色（ECS任务生命周期管理必备） #

这个角色负责ECS任务的启动、日志推送等操作，同时需要允许传递容器级IAM角色：

resource "aws_iam_role" "ecs_task_execution_role" {
  name = "ecs-sidecar-task-execution-role"

  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action = "sts:AssumeRole"
        Effect = "Allow"
        Principal = {
          Service = "ecs-tasks.amazonaws.com"
        }
      }
    ]
  })
}

resource "aws_iam_role_policy_attachment" "ecs_task_execution_role_policy" {
  role       = aws_iam_role.ecs_task_execution_role.name
  policy_arn = "arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy"
}

# 添加PassRole权限，允许传递容器级IAM角色
resource "aws_iam_role_policy" "ecs_task_execution_pass_role" {
  name   = "ecs-task-execution-pass-container-role"
  role   = aws_iam_role.ecs_task_execution_role.id
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action = "iam:PassRole"
        Effect = "Allow"
        Resource = [
          aws_iam_role.business_container_role.arn
        ]
      }
    ]
  })
}

2. 定义业务容器的IAM角色（具备S3+SQS访问权限） #

resource "aws_iam_role" "business_container_role" {
  name = "ecs-sidecar-business-container-role"

  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action = "sts:AssumeRole"
        Effect = "Allow"
        Principal = {
          Service = "ecs-tasks.amazonaws.com"
        }
      }
    ]
  })
}

# 配置S3和SQS的权限策略
resource "aws_iam_role_policy" "business_container_permissions" {
  name   = "s3-sqs-access-policy"
  role   = aws_iam_role.business_container_role.id
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action = [
          "s3:GetObject",
          "s3:PutObject"
        ]
        Effect   = "Allow"
        Resource = "arn:aws:s3:::your-bucket-name/*"
      },
      {
        Action = [
          "sqs:SendMessage",
          "sqs:ReceiveMessage"
        ]
        Effect   = "Allow"
        Resource = "arn:aws:sqs:${var.region}:${var.account_id}:your-queue-name"
      }
    ]
  })
}

3. 定义ECS任务定义（包含两个容器，分别配置IAM角色） #

resource "aws_ecs_task_definition" "sidecar_task" {
  family                   = "sidecar-task-family"
  network_mode             = "awsvpc"
  requires_compatibilities = ["FARGATE"] # 支持EC2或FARGATE
  cpu                      = "256"
  memory                   = "512"
  execution_role_arn       = aws_iam_role.ecs_task_execution_role.arn

  container_definitions = jsonencode([
    {
      name      = "business-container"
      image     = "your-business-image:latest"
      essential = true
      # 指定该容器的IAM角色
      iamRole = aws_iam_role.business_container_role.arn
      # 其他容器配置：端口、日志等
      logConfiguration = {
        logDriver = "awslogs"
        options = {
          awslogs-group         = "/ecs/sidecar-task"
          awslogs-region        = var.region
          awslogs-stream-prefix = "ecs"
        }
      }
    },
    {
      name      = "sidecar-container"
      image     = "your-sidecar-image:latest"
      essential = true
      # 不指定iamRole，该容器无额外IAM权限
      logConfiguration = {
        logDriver = "awslogs"
        options = {
          awslogs-group         = "/ecs/sidecar-task"
          awslogs-region        = var.region
          awslogs-stream-prefix = "ecs"
        }
      }
    }
  ])
}

注意事项 #

• 容器级IAM角色支持Fargate和EC2启动类型的ECS任务，需确保集群使用的ECS Agent版本为1.45.0及以上。
• 不需要权限的容器可直接省略iamRole字段，此时该容器仅能使用任务执行角色的基础权限（任务执行角色通常仅用于任务管理，无业务权限）；也可分配一个无任何权限的IAM角色进一步缩小权限范围。
• 确保iam:PassRole权限的资源范围仅包含需要传递的容器角色ARN，避免过度授权。

内容的提问来源于stack exchange，提问作者Braden Crimmins