ECS Fargate任务读取Kinesis数据流时IAM角色扮演错误排查

问题根因 #

你遇到的报错由两个配置缺失导致：

• ECS任务角色ecsTaskRole的信任策略（Assume Role Policy）配置错误，不允许ECS任务服务扮演该角色
• ecsTaskRole没有配置访问Kinesis数据流的权限规则

具体修复方案 #

1. 修改ECS任务角色的信任策略 #

你当前ecsTaskRole的信任策略仅允许当前AWS账户的root身份调用sts:AssumeRole，但Fargate启动任务时，需要由ECS任务服务代为扮演该角色，需要将信任主体修改为ecs-tasks.amazonaws.com，修改后的配置如下：

data "aws_iam_policy_document" "ecsTaskRole" {
  statement {
    effect  = "Allow"
    actions = ["sts:AssumeRole"]
    principals {
      type        = "Service"
      identifiers = ["ecs-tasks.amazonaws.com"]
    }
  }
}

2. 给ECS任务角色添加Kinesis访问权限 #

你需要给ecsTaskRole绑定对应Kinesis数据流的访问权限，参考配置如下（可根据实际业务需要调整允许的操作、Kinesis流ARN范围）：

# 自定义Kinesis访问策略
data "aws_iam_policy_document" "kinesis_access_policy" {
  statement {
    effect = "Allow"
    actions = [
      "kinesis:PutRecord",
      "kinesis:PutRecords",
      "kinesis:GetRecords",
      "kinesis:GetShardIterator",
      "kinesis:DescribeStream"
    ]
    # 替换为你实际的Kinesis数据流ARN
    resources = ["arn:aws:kinesis:${data.aws_region.current.name}:${data.aws_caller_identity.current.account_id}:stream/你的Kinesis流名称"]
  }
}

resource "aws_iam_role_policy" "ecs_task_kinesis_policy" {
  name   = "ecs-task-kinesis-access-policy"
  role   = aws_iam_role.ecsTaskRole.id
  policy = data.aws_iam_policy_document.kinesis_access_policy.json
}

内容的提问来源于stack exchange，提问作者George Ferreira