Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Amazon managed policies for Amazon Elastic Container Service

To add permissions to users, groups, and roles, it is easier to use Amazon managed policies than to write policies yourself. It takes time and expertise to create IAM customer managed policies that provide your team with only the permissions they need. To get started quickly, you can use our Amazon managed policies. These policies cover common use cases and are available in your Amazon account. For more information about Amazon managed policies, see Amazon managed policies in the IAM User Guide.

Amazon services maintain and update Amazon managed policies. You can't change the permissions in Amazon managed policies. Services occasionally add additional permissions to an Amazon managed policy to support new features. This type of update affects all identities (users, groups, and roles) where the policy is attached. Services are most likely to update an Amazon managed policy when a new feature is launched or when new operations become available. Services do not remove permissions from an Amazon managed policy, so policy updates won't break your existing permissions.

Additionally, Amazon supports managed policies for job functions that span multiple services. For example, the ReadOnlyAccess Amazon managed policy provides read-only access to all Amazon services and resources. When a service launches a new feature, Amazon adds read-only permissions for new operations and resources. For a list and descriptions of job function policies, see Amazon managed policies for job functions in the IAM User Guide.

Amazon ECS and Amazon ECR provide several managed policies and trust relationships that you can attach to users, groups, roles, Amazon EC2 instances, and Amazon ECS tasks that allow differing levels of control over resources and API operations. You can apply these policies directly, or you can use them as starting points for creating your own policies. For more information about the Amazon ECR managed policies, see Amazon ECR managed policies.

AmazonECS_FullAccess

You can attach the AmazonECS_FullAccess policy to your IAM identities. This policy grants administrative access to Amazon ECS resources and grants an IAM identity (such as a user, group, or role) access to the Amazon services that Amazon ECS is integrated with to use all of Amazon ECS features. Using this policy allows access to all of Amazon ECS features that are available in the Amazon Web Services Management Console.

To view the permissions for this policy, see AmazonECS_FullAccess in the Amazon Managed Policy Reference.

AmazonECSInfrastructureRolePolicyForVolumes

You can attach the AmazonECSInfrastructureRolePolicyForVolumes managed policy to your IAM entities.

The policy grants the permissions that are needed by Amazon ECS to make Amazon API calls on your behalf. You can attach this policy to the IAM role that you provide with your volume configuration when launching Amazon ECS tasks and services. The role enables Amazon ECS to manage volumes attached to your tasks. For more information, see Amazon ECS infrastructure IAM role.

To view the permissions for this policy, see AmazonECSInfrastructureRolePolicyForVolumes in the Amazon Managed Policy Reference.

AmazonEC2ContainerServiceforEC2Role

You can attach the AmazonEC2ContainerServiceforEC2Role policy to your IAM identities. This policy grants administrative permissions that allow Amazon ECS container instances to make calls to Amazon on your behalf. For more information, see Amazon ECS container instance IAM role.

Amazon ECS attaches this policy to a service role that allows Amazon ECS to perform actions on your behalf against Amazon EC2 instances or external instances.

To view the permissions for this policy, see AmazonEC2ContainerServiceforEC2Role in the Amazon Managed Policy Reference.

Considerations

You should consider the following recommendations and considerations when using the AmazonEC2ContainerServiceforEC2Role managed IAM policy.

AmazonEC2ContainerServiceEventsRole

You can attach the AmazonEC2ContainerServiceEventsRole policy to your IAM identities. This policy grants permissions that allow Amazon EventBridge (formerly CloudWatch Events) to run tasks on your behalf. This policy can be attached to the IAM role that's specified when you create scheduled tasks. For more information, see Amazon ECS EventBridge IAM Role.

To view the permissions for this policy, see AmazonEC2ContainerServiceEventsRole in the Amazon Managed Policy Reference.

AmazonECSTaskExecutionRolePolicy

The AmazonECSTaskExecutionRolePolicy managed IAM policy grants the permissions that are needed by the Amazon ECS container agent and Amazon Fargate container agents to make Amazon API calls on your behalf. This policy can be added to your task execution IAM role. For more information, see Amazon ECS task execution IAM role.

To view the permissions for this policy, see AmazonECSTaskExecutionRolePolicy in the Amazon Managed Policy Reference.

AmazonECSServiceRolePolicy

The AmazonECSServiceRolePolicy managed IAM policy enables Amazon Elastic Container Service to manage your cluster. This policy can be added to your task execution IAM role. For more information, see Amazon ECS task execution IAM role.

To view the permissions for this policy, see AmazonECSServiceRolePolicy in the Amazon Managed Policy Reference.

AmazonECSInfrastructureRolePolicyForServiceConnectTransportLayerSecurity

You can attach the AmazonECSInfrastructureRolePolicyForServiceConnectTransportLayerSecurity policy to your IAM entities. This policy grants administrative access to Amazon Private Certificate Authority, Secrets Manager and other Amazon Services required to manage Amazon ECS Service Connect TLS features on your behalf.

To view the permissions for this policy, see AmazonECSInfrastructureRolePolicyForServiceConnectTransportLayerSecurity in the Amazon Managed Policy Reference.

AWSApplicationAutoscalingECSServicePolicy

You can't attach AWSApplicationAutoscalingECSServicePolicy to your IAM entities. This policy is attached to a service-linked role that allows Application Auto Scaling to perform actions on your behalf. For more information, see Service-linked roles for Application Auto Scaling.

To view the permissions for this policy, see AWSApplicationAutoscalingECSServicePolicy in the Amazon Managed Policy Reference.

AWSCodeDeployRoleForECS

You can't attach AWSCodeDeployRoleForECS to your IAM entities. This policy is attached to a service-linked role that allows CodeDeploy to perform actions on your behalf. For more information, see Create a service role for CodeDeploy in the Amazon CodeDeploy User Guide.

To view the permissions for this policy, see AWSCodeDeployRoleForECS in the Amazon Managed Policy Reference.

AWSCodeDeployRoleForECSLimited

You can't attach AWSCodeDeployRoleForECSLimited to your IAM entities. This policy is attached to a service-linked role that allows CodeDeploy to perform actions on your behalf. For more information, see Create a service role for CodeDeploy in the Amazon CodeDeploy User Guide.

To view the permissions for this policy, see AWSCodeDeployRoleForECSLimited in the Amazon Managed Policy Reference.

AmazonECSInfrastructureRolePolicyForVpcLattice

You can attach the AmazonECSInfrastructureRolePolicyForVpcLattice policy to your IAM entities. This policy Provides access to other Amazon service resources required to manage VPC Lattice feature in Amazon ECS workloads on your behalf.

To view the permissions for this policy, see AmazonECSInfrastructureRolePolicyForVpcLattice in the Amazon Managed Policy Reference.

Provides access to other Amazon service resources required to manage VPC Lattice feature in Amazon ECS workloads on your behalf.

Amazon ECS updates to Amazon managed policies

View details about updates to Amazon managed policies for Amazon ECS since this service started tracking these changes. For automatic alerts about changes to this page, subscribe to the RSS feed on the Amazon ECS Document history page.