如何配置AWS ECS Service Connect TLS所需的IAM角色？

问题场景 #

我使用Terraform的aws_ecs_service资源创建带Service Connect的ECS服务并启用TLS时，配置了如下tls块：

tls {
  role_arn = var.service_connect_tls_role_arn
  issuer_cert_authority {
    aws_pca_authority_arn = var.service_connect_pca_arn
  }
}

同时创建了对应的IAM角色：

resource "aws_iam_role" "cdr_client_ecs_service_tls_role" {
  name = "cdr-client-ecs-service-tls-role"

  assume_role_policy = jsonencode({
    Version = "2012-10-17",
    Statement = [{
      Action = "sts:AssumeRole",
      Effect = "Allow",
      Principal = {
        Service = "ecs-tasks.amazonaws.com"
      }
    }]
  })

  inline_policy {
    name = "cdr-client-ecs-service-tls-policy"
    policy = jsonencode({
      "Version" : "2012-10-17",
      "Statement" : [
        {
          "Action" : [
            "acm-pca:DescribeCertificateAuthority"
          ],
          "Effect" : "Allow",
          "Resource" : "*",
        }
      ]
    })
  }
}

执行terraform apply时触发错误：

Error: creating ECS Service (client-super): InvalidParameterException: Unable to assume the role arn:aws:iam::111111111:role/cdr-client-ecs-service-tls-role

正确配置方案 #

1. 修正信任策略的服务主体 #

ECS Service Connect的TLS角色需要被ecs.amazonaws.com服务主体 Assume，而非ecs-tasks.amazonaws.com，这是导致角色无法被正确假设的核心原因。

2. 补充必要的IAM权限 #

除了acm-pca:DescribeCertificateAuthority，角色还需要acm-pca:GetCertificate和acm-pca:IssueCertificate权限，才能从AWS PCA获取并签发证书用于Service Connect TLS加密。

3. 限制资源范围（可选但推荐） #

将权限中的资源范围从*改为目标PCA的ARN，遵循最小权限原则，降低权限风险。

修正后的完整IAM角色代码 #

resource "aws_iam_role" "cdr_client_ecs_service_tls_role" {
  name = "cdr-client-ecs-service-tls-role"

  assume_role_policy = jsonencode({
    Version = "2012-10-17",
    Statement = [{
      Action = "sts:AssumeRole",
      Effect = "Allow",
      Principal = {
        Service = "ecs.amazonaws.com"
      }
    }]
  })

  inline_policy {
    name = "cdr-client-ecs-service-tls-policy"
    policy = jsonencode({
      "Version" : "2012-10-17",
      "Statement" : [
        {
          "Action" : [
            "acm-pca:DescribeCertificateAuthority",
            "acm-pca:GetCertificate",
            "acm-pca:IssueCertificate"
          ],
          "Effect" : "Allow",
          "Resource" : var.service_connect_pca_arn
        }
      ]
    })
  }
}

内容的提问来源于stack exchange，提问作者Douglas Woods