配置ECS权限后，用CloudFormation注册任务定义仍报错求助

问题背景 #

通过CloudFormation模板创建ECS任务定义时，已配置包含ecs:RegisterTaskDefinition在内的IAM策略，但执行过程中仍收到如下权限错误：

ECS Task definition error invalid request provided: Create TaskDefinition: User: arn:aws:sts::XXX:assumed-role/ADO_ROLE/aws-vsts-tools is not authorized to perform: ecs:RegisterTaskDefinition on resource: * because no identity-based policy allows the ecs:RegisterTaskDefinition action

当前使用的IAM策略如下：

{
"Version": "2012-10-17",
"Statement": [
    {
        "Sid": "ECSManageRole",
        "Effect": "Allow",
        "Action": [
            "ecs:UpdateTaskSet",
            "ecs:UpdateServicePrimaryTaskSet",
            "ecs:UpdateService",
            "ecs:UpdateContainerInstancesState",
            "ecs:UpdateContainerAgent",
            "ecs:UpdateCapacityProvider",
            "ecs:TagResource",
            "ecs:Submit*",
            "ecs:StopTask",
            "ecs:StartTelemetrySession",
            "ecs:StartTask",
            "ecs:RunTask",
            "ecs:RegisterTaskDefinition",
            "ecs:PutClusterCapacityProviders",
            "ecs:ListTasks",
            "ecs:ListTaskDefinitions",
            "ecs:ListTaskDefinitionFamilies",
            "ecs:ListServices",
            "ecs:ListContainerInstances",
            "ecs:ListClusters",
            "ecs:ExecuteCommand",
            "ecs:DescribeTasks",
            "ecs:DescribeTaskDefinition",
            "ecs:DescribeServices",
            "ecs:DescribeContainerInstances",
            "ecs:DescribeClusters",
            "ecs:DescribeCapacityProviders",
            "ecs:DeregisterTaskDefinition",
            "ecs:DeregisterContainerInstance",
            "ecs:DeleteTaskSet",
            "ecs:DeleteService",
            "ecs:CreateTaskSet",
            "ecs:CreateService",
            "ecs:CreateCapacityProvider"
        ],
        "Resource": "arn:aws:ecs:us-east-1:XXX:*"
    },
    {
        "Sid": "ECSReadRole",
        "Effect": "Allow",
        "Action": [
            "ecs:List*",
            "ecs:Describe*"
        ],
        "Resource": "arn:aws:ecs:us-east-1:XXX:*"
    }
]
}

（注：策略中存在重复的读写权限操作，但不影响当前问题）

问题分析 #

错误提示明确显示，请求在资源*上执行ecs:RegisterTaskDefinition动作时被拒绝。尽管当前策略指定的资源arn:aws:ecs:us-east-1:XXX:*看似覆盖了该区域下所有ECS资源，但CloudFormation调用RegisterTaskDefinition API时，是以资源*的形式发起请求，导致策略中的资源匹配规则无法命中。

此外，ecs:RegisterTaskDefinition对应的资源类型为task-definition，标准的资源ARN格式应为arn:aws:ecs:us-east-1:XXX:task-definition/*，当前策略中的ARN虽然理论上包含任务定义，但AWS权限引擎在部分场景下会严格校验资源类型，导致匹配失败。

解决方案 #

方案1：放宽资源范围至所有资源 #

将IAM策略中ECSManageRole声明的Resource字段修改为*，确保覆盖所有资源请求场景：

{
"Version": "2012-10-17",
"Statement": [
    {
        "Sid": "ECSManageRole",
        "Effect": "Allow",
        "Action": [
            "ecs:UpdateTaskSet",
            "ecs:UpdateServicePrimaryTaskSet",
            "ecs:UpdateService",
            "ecs:UpdateContainerInstancesState",
            "ecs:UpdateContainerAgent",
            "ecs:UpdateCapacityProvider",
            "ecs:TagResource",
            "ecs:Submit*",
            "ecs:StopTask",
            "ecs:StartTelemetrySession",
            "ecs:StartTask",
            "ecs:RunTask",
            "ecs:RegisterTaskDefinition",
            "ecs:PutClusterCapacityProviders",
            "ecs:ListTasks",
            "ecs:ListTaskDefinitions",
            "ecs:ListTaskDefinitionFamilies",
            "ecs:ListServices",
            "ecs:ListContainerInstances",
            "ecs:ListClusters",
            "ecs:ExecuteCommand",
            "ecs:DescribeTasks",
            "ecs:DescribeTaskDefinition",
            "ecs:DescribeServices",
            "ecs:DescribeContainerInstances",
            "ecs:DescribeClusters",
            "ecs:DescribeCapacityProviders",
            "ecs:DeregisterTaskDefinition",
            "ecs:DeregisterContainerInstance",
            "ecs:DeleteTaskSet",
            "ecs:DeleteService",
            "ecs:CreateTaskSet",
            "ecs:CreateService",
            "ecs:CreateCapacityProvider"
        ],
        "Resource": "*"
    },
    {
        "Sid": "ECSReadRole",
        "Effect": "Allow",
        "Action": [
            "ecs:List*",
            "ecs:Describe*"
        ],
        "Resource": "arn:aws:ecs:us-east-1:XXX:*"
    }
]
}

方案2：精准指定任务定义资源 #

在ECSManageRole的Resource字段中添加任务定义专属的ARN格式，确保匹配API请求：

{
"Version": "2012-10-17",
"Statement": [
    {
        "Sid": "ECSManageRole",
        "Effect": "Allow",
        "Action": [
            "ecs:UpdateTaskSet",
            "ecs:UpdateServicePrimaryTaskSet",
            "ecs:UpdateService",
            "ecs:UpdateContainerInstancesState",
            "ecs:UpdateContainerAgent",
            "ecs:UpdateCapacityProvider",
            "ecs:TagResource",
            "ecs:Submit*",
            "ecs:StopTask",
            "ecs:StartTelemetrySession",
            "ecs:StartTask",
            "ecs:RunTask",
            "ecs:RegisterTaskDefinition",
            "ecs:PutClusterCapacityProviders",
            "ecs:ListTasks",
            "ecs:ListTaskDefinitions",
            "ecs:ListTaskDefinitionFamilies",
            "ecs:ListServices",
            "ecs:ListContainerInstances",
            "ecs:ListClusters",
            "ecs:ExecuteCommand",
            "ecs:DescribeTasks",
            "ecs:DescribeTaskDefinition",
            "ecs:DescribeServices",
            "ecs:DescribeContainerInstances",
            "ecs:DescribeClusters",
            "ecs:DescribeCapacityProviders",
            "ecs:DeregisterTaskDefinition",
            "ecs:DeregisterContainerInstance",
            "ecs:DeleteTaskSet",
            "ecs:DeleteService",
            "ecs:CreateTaskSet",
            "ecs:CreateService",
            "ecs:CreateCapacityProvider"
        ],
        "Resource": [
            "arn:aws:ecs:us-east-1:XXX:*",
            "arn:aws:ecs:us-east-1:XXX:task-definition/*"
        ]
    },
    {
        "Sid": "ECSReadRole",
        "Effect": "Allow",
        "Action": [
            "ecs:List*",
            "ecs:Describe*"
        ],
        "Resource": "arn:aws:ecs:us-east-1:XXX:*"
    }
]
}

修改完成后，重新为目标角色附加该策略，等待权限生效（通常1-5分钟），再执行CloudFormation部署即可解决权限问题。

内容的提问来源于stack exchange，提问作者Sanjesh M