Setup task role

[wichert]

The ECS documentation suggests best practice is to setup a task role to limit what your task can do. As far as I can see something like this should work:

    TaskRole:
        Type: AWS::IAM::Role
        Properties:
            AssumeRolePolicyDocument:
              Version: "2012-10-17"
              Statement:
                - Effect: Allow
                  Principal:
                    Service: "ecs-tasks.amazonaws.com"
                  Action:
                    - "sts:AssumeRole"
            ManagedPolicyArns:
              - "arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceforEC2Role"


    TaskDefinition:
        Type: AWS::ECS::TaskDefinition
        Properties:
            TaskRoleArn: !GetAtt TaskRole.Arn
            Family: product-service
            ....

[liozzazhang]

it works fine. thanks