ecs-tasks.amazonaws.com向STS服务提供的元数据及对应条件键咨询

Great question—hardening ECS task role permissions to prevent unauthorized impersonation is critical, and it’s totally fair that the AWS docs don’t spell this out explicitly for ecs-tasks.amazonaws.com. Let’s break down what metadata gets sent to STS, plus the condition keys you can use to lock down access:

Metadata Sent to STS by ecs-tasks.amazonaws.com #

When an ECS task (whether on EC2 or Fargate) assumes its assigned IAM role, ecs-tasks.amazonaws.com includes these core pieces of metadata in the sts:AssumeRole request:

• Task ARN: The unique Amazon Resource Name of the specific ECS task making the request (e.g., arn:aws:ecs:us-east-1:123456789012:task/my-cluster/abc123xyz). This is the most precise identifier for the task.
• Cluster Name/ARN: The name and ARN of the ECS cluster where the task is running.
• Task Definition ARN: The ARN of the task definition used to launch the task (including the revision number).
• AWS Account ID: The account that owns the ECS task and cluster.
• For EC2-launched tasks: The ARN/ID of the container instance hosting the task (less relevant for Fargate, since it’s serverless).

Condition Keys to Restrict Role Impersonation #

Even though AWS docs don’t explicitly list ecs-tasks.amazonaws.com for these keys, they are fully supported for ECS task role assumption. Here are the most useful ones:

• aws:SourceArn: Match the ARN of the ECS task making the request. Use wildcards (like *) to target all tasks in a cluster, e.g., arn:aws:ecs:us-east-1:123456789012:task/my-cluster/*.
• aws:SourceAccount: Restrict access to only tasks owned by your AWS account ID (prevents cross-account impersonation attempts).
• ecs:ClusterName: Lock the role to only tasks running in a specific cluster (e.g., "ecs:ClusterName": "my-production-cluster").
• ecs:TaskDefinitionArn: Limit access to tasks using a specific task definition (including revisions, e.g., "ecs:TaskDefinitionArn": "arn:aws:ecs:us-east-1:123456789012:task-definition/my-app-task:10").

Example Trust Policy #

Here’s how you’d combine these keys in a task role’s trust policy to prevent unauthorized impersonation:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "ecs-tasks.amazonaws.com"
      },
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringEquals": {
          "aws:SourceAccount": "123456789012",
          "ecs:ClusterName": "my-production-cluster",
          "ecs:TaskDefinitionArn": "arn:aws:ecs:us-east-1:123456789012:task-definition/my-app-task:10"
        },
        "ArnLike": {
          "aws:SourceArn": "arn:aws:ecs:us-east-1:123456789012:task/my-production-cluster/*"
        }
      }
    }
  ]
}

A quick note: For Fargate tasks, all these keys work just as well as they do for EC2 tasks—Fargate tasks still have unique task ARNs and are tied to specific clusters/task definitions.

内容的提问来源于stack exchange，提问作者Utkarsh Malviya