Separate ECS application permissions from task execution permissions

Give workload code its own task role rather than broadening the infrastructure role.

Source facts

An ECS task IAM role supplies AWS permissions to application code in the containers. The ECS task execution role serves the agents that pull images and run tasks. Task roles support workload-specific permissions and audit context. AWS warns that containers on a shared EC2 host are not a security boundary merely because task roles are assigned.

Source: AWS Documentation.

Applicability

This applies to ECS IAM role design, with isolation differences between compute options considered separately.

DSE recommendation

DSE recommends recording the application actions and resources before defining its task role. Review image-pull, logging and startup requirements under the execution-role owner separately. Avoid placing every application permission in the underlying instance profile. Inspect access to host metadata and co-located workload credentials when choosing the compute and isolation model. Keep the task definition, role ARNs and permission rationale together so deployment troubleshooting does not merge unrelated trust responsibilities. Put the application role and execution role in separate rows of the task-definition review. Ask reviewers to trace one representative permission to its actual consumer and require an explicit justification when troubleshooting proposes to add application access to a different infrastructure identity.

Verification

Proposed verification: run an approved test task, inspect the role used for an application API request and confirm it can reach only the intended resources. Check startup behavior separately. Review host-isolation assumptions rather than presenting a successful task-role test as proof of container isolation.

Official reference

AWS Documentation. Reviewed October 20, 2026.