ECS服务任务无法创建日志流问题求助

搭建新ECS Service时，Task无法为服务创建日志流，ECS Task界面顶部出现日志相关权限错误。当前使用的执行角色IAM配置如下：

MyExecutionRole:
  Type: AWS::IAM::Role
  Properties:
    AssumeRolePolicyDocument:
      Version: "2012-10-17"
      Statement:
        - Effect: Allow
          Principal:
            Service: ecs-tasks.amazonaws.com
          Action: sts:AssumeRole
    ManagedPolicyArns:
      - arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy
      - arn:aws:iam::aws:policy/CloudWatchFullAccess
    Policies:
      - PolicyName: "ECR"
        PolicyDocument:
          Version: "2012-10-17"
          Statement:
            - Effect: Allow
              Action: 
                - ecr:BatchGetImage
                - ecr:GetDownloadUrlForLayer
                - ecr:GetAuthorizationToken
              Resource: "*"
      - PolicyName: "Logs"
        PolicyDocument:
          Version: "2012-10-17"
          Statement:
            - Effect: Allow
              Action:
                - logs:Create
                - logs:PutLogEvents
                - logs:CreateLogStream
                - logs:PutDestination
              Resource: !Sub "arn:aws:logs:${AWS::Region}:${AWS::AccountId}:*"
      - PolicyName: "GetSecrets"
        PolicyDocument:
          Version: "2012-10-17"
          Statement:
            - Effect: Allow
              Action:
                - ssm:GetParameters
                - kms:Decrypt
                - secretsmanager:GetSecretValue
              Resource:
                - !Sub "arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/*"
                - !Sub "arn:aws:secretsmanager:${AWS::Region}:${AWS::AccountId}:secret:*"
                - !Sub "arn:aws:kms:${AWS::Region}:${AWS::AccountId}:key/*"

解决方案 #

• 修正Logs策略中的无效Action
  自定义Logs策略里的logs:Create不是AWS CloudWatch Logs的有效操作，Task创建日志流前需要先创建日志组，对应的正确权限是logs:CreateLogGroup。替换后策略如下：

- PolicyName: "Logs"
  PolicyDocument:
    Version: "2012-10-17"
    Statement:
      - Effect: Allow
        Action:
          - logs:CreateLogGroup
          - logs:PutLogEvents
          - logs:CreateLogStream
          - logs:PutDestination
        Resource: !Sub "arn:aws:logs:${AWS::Region}:${AWS::AccountId}:*"

• 检查权限冗余（可选）
  你已经附加了AmazonECSTaskExecutionRolePolicy（包含ECS任务执行所需的基础日志权限）和CloudWatchFullAccess（全量CloudWatch权限），这两个托管策略已经覆盖了日志组、日志流的创建和写入权限。如果不需要自定义Logs策略，可以直接删除该自定义策略，避免权限配置重复。

• 确认角色关联正确性
  检查ECS Task Definition中指定的执行角色是否确实为MyExecutionRole，避免出现角色配置不匹配的情况。

内容的提问来源于stack exchange，提问作者Joseph Quinn