Operations Actions Permission-only actions Resource types Condition keys

Actions, resources, and condition keys for Amazon Elastic Container Service

Amazon Elastic Container Service (service prefix: ecs) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Topics

API operations defined by Amazon Elastic Container Service
Actions defined by Amazon Elastic Container Service
Permission-only actions for Amazon Elastic Container Service
Resource types defined by Amazon Elastic Container Service
Condition keys for Amazon Elastic Container Service

API operations defined by Amazon Elastic Container Service

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Condition key	Possible value(s)	Access level
ContinueServiceDeployment	ecs:ContinueServiceDeployment			Write
CreateCapacityProvider	ecs:CreateCapacityProvider			Write
	ecs:PutClusterCapacityProviders			Write
	ecs:TagResource			Tagging, Write
	iam:PassRole	iam:PassedToService	ecs.amazonaws.com	Write
CreateCluster	ecs:CreateCluster			Write
CreateCluster	ecs:TagResource			Tagging, Write
CreateDaemon	ecs:CreateDaemon			Write
	ecs:TagResource			Tagging, Write
	iam:PassRole	iam:PassedToService	ecs-tasks.amazonaws.com	Write
CreateExpressGatewayService	ecs:CreateCluster			Write
	ecs:CreateExpressGatewayService			Write
	ecs:RegisterTaskDefinition			Write
	ecs:TagResource			Tagging, Write
	iam:PassRole	iam:PassedToService	ecs-tasks.amazonaws.com, ecs.amazonaws.com	Write
CreateService	ecs:CreateService			Write
	ecs:TagResource			Tagging, Write
	iam:PassRole	iam:PassedToService	ecs-tasks.amazonaws.com, ecs.amazonaws.com	Write
CreateTaskSet	ecs:CreateTaskSet			Write
	ecs:TagResource			Tagging, Write
	iam:PassRole	iam:PassedToService	ecs-tasks.amazonaws.com	Write
DeleteAccountSetting	ecs:DeleteAccountSetting			Write
DeleteAttributes	ecs:DeleteAttributes			Write
DeleteCapacityProvider	ecs:DeleteCapacityProvider			Write
DeleteCapacityProvider	ecs:PutClusterCapacityProviders			Write
DeleteCluster	ecs:DeleteCluster			Write
DeleteDaemon	ecs:DeleteDaemon			Write
DeleteDaemonTaskDefinition	ecs:DeleteDaemonTaskDefinition			Write
DeleteExpressGatewayService	ecs:DeleteExpressGatewayService			Write
DeleteService	ecs:DeleteService			Write
DeleteTaskDefinitions	ecs:DeleteTaskDefinitions			Write
DeleteTaskSet	ecs:DeleteTaskSet			Write
DeregisterContainerInstance	ecs:DeregisterContainerInstance			Write
DeregisterTaskDefinition	ecs:DeregisterTaskDefinition			Write
DescribeCapacityProviders	ecs:DescribeCapacityProviders			Read
DescribeClusters	ecs:DescribeClusters			Read
DescribeContainerInstances	ecs:DescribeContainerInstances			Read
DescribeDaemon	ecs:DescribeDaemon			Read
DescribeDaemonDeployments	ecs:DescribeDaemonDeployments			Read
DescribeDaemonRevisions	ecs:DescribeDaemonRevisions			Read
DescribeDaemonTaskDefinition	ecs:DescribeDaemonTaskDefinition			Read
DescribeExpressGatewayService	ecs:DescribeExpressGatewayService			Read
DescribeServiceDeployments	ecs:DescribeServiceDeployments			Read
DescribeServiceRevisions	ecs:DescribeServiceRevisions			Read
DescribeServices	ecs:DescribeServices			Read
DescribeTaskDefinition	ecs:DescribeTaskDefinition			Read
DescribeTaskSets	ecs:DescribeTaskSets			Read
DescribeTasks	ecs:DescribeTasks			Read
DiscoverPollEndpoint	ecs:DiscoverPollEndpoint			Write
ExecuteCommand	ecs:ExecuteCommand			Write
GetTaskProtection	ecs:GetTaskProtection			Read
ListAccountSettings	ecs:ListAccountSettings			Read
ListAttributes	ecs:ListAttributes			List
ListClusters	ecs:ListClusters			List
ListContainerInstances	ecs:ListContainerInstances			List
ListDaemonDeployments	ecs:ListDaemonDeployments			List
ListDaemonTaskDefinitions	ecs:ListDaemonTaskDefinitions			List
ListDaemons	ecs:ListDaemons			List
ListServiceDeployments	ecs:ListServiceDeployments			List
ListServices	ecs:ListServices			List
ListServicesByNamespace	ecs:ListServicesByNamespace			List
ListTagsForResource	ecs:ListTagsForResource			Read
ListTaskDefinitionFamilies	ecs:ListTaskDefinitionFamilies			List
ListTaskDefinitions	ecs:ListTaskDefinitions			List
ListTasks	ecs:ListTasks			List
PutAccountSetting	ecs:PutAccountSetting			Write
PutAccountSettingDefault	ecs:PutAccountSettingDefault			Write
PutAttributes	ecs:PutAttributes			Write
PutClusterCapacityProviders	ecs:PutClusterCapacityProviders			Write
RegisterContainerInstance	ecs:RegisterContainerInstance			Write
RegisterContainerInstance	ecs:TagResource			Tagging, Write
RegisterDaemonTaskDefinition	ecs:RegisterDaemonTaskDefinition			Write
	ecs:TagResource			Tagging, Write
	iam:PassRole	iam:PassedToService	ecs-tasks.amazonaws.com	Write
RegisterTaskDefinition	ecs:RegisterTaskDefinition			Write
	ecs:TagResource			Tagging, Write
	iam:PassRole	iam:PassedToService	ecs-tasks.amazonaws.com	Write
RunTask	ecs:RunTask			Write
	ecs:TagResource			Tagging, Write
	iam:PassRole	iam:PassedToService	ecs-tasks.amazonaws.com, ecs.amazonaws.com	Write
StartTask	ecs:StartTask			Write
	ecs:TagResource			Tagging, Write
	iam:PassRole	iam:PassedToService	ecs-tasks.amazonaws.com, ecs.amazonaws.com	Write
StopServiceDeployment	ecs:StopServiceDeployment			Write
StopTask	ecs:StopTask			Write
SubmitAttachmentStateChanges	ecs:SubmitAttachmentStateChanges			Write
SubmitContainerStateChange	ecs:SubmitContainerStateChange			Write
SubmitTaskStateChange	ecs:SubmitTaskStateChange			Write
TagResource	ecs:TagResource			Tagging, Write
UntagResource	ecs:UntagResource			Tagging, Write
UpdateCapacityProvider	ecs:PutClusterCapacityProviders			Write
	ecs:UpdateCapacityProvider			Write
	iam:PassRole	iam:PassedToService	ecs.amazonaws.com	Write
UpdateCluster	ecs:UpdateCluster			Write
UpdateClusterSettings	ecs:UpdateClusterSettings			Write
UpdateContainerAgent	ecs:UpdateContainerAgent			Write
UpdateContainerInstancesState	ecs:UpdateContainerInstancesState			Write
UpdateDaemon	ecs:UpdateDaemon			Write
UpdateDaemon	iam:PassRole	iam:PassedToService	ecs-tasks.amazonaws.com	Write
UpdateExpressGatewayService	ecs:RegisterTaskDefinition			Write
	ecs:UpdateExpressGatewayService			Write
	iam:PassRole	iam:PassedToService	ecs-tasks.amazonaws.com, ecs.amazonaws.com	Write
UpdateService	ecs:UpdateService			Write
UpdateService	iam:PassRole	iam:PassedToService	ecs-tasks.amazonaws.com, ecs.amazonaws.com	Write
UpdateServicePrimaryTaskSet	ecs:UpdateServicePrimaryTaskSet			Write
UpdateTaskProtection	ecs:UpdateTaskProtection			Write
UpdateTaskSet	ecs:UpdateTaskSet			Write

Actions defined by Amazon Elastic Container Service

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in Amazon. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
ContinueServiceDeployment	Grants permission to continue a paused service deployment	service*	aws:ResourceTag/${TagKey} ecs:cluster ecs:ResourceTag/${TagKey}	Write
ContinueServiceDeployment	Grants permission to continue a paused service deployment	service-deployment*	aws:ResourceTag/${TagKey} ecs:cluster ecs:service	Write
CreateCapacityProvider	Grants permission to create a new capacity provider. Capacity providers are associated with an Amazon ECS cluster and are used in capacity provider strategies to facilitate cluster auto scaling	capacity-provider*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys ecs:instance-metadata-tags-propagation ecs:propagate-tags ecs:ResourceTag/${TagKey}	Write
CreateCluster	Grants permission to create a new Amazon ECS cluster	cluster*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys ecs:capacity-provider ecs:fargate-ephemeral-storage-kms-key ecs:ResourceTag/${TagKey}	Write
CreateDaemon	Grants permission to create a new daemon in a specified cluster	daemon*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys ecs:capacity-provider ecs:cluster ecs:daemon-task-definition ecs:enable-ecs-managed-tags ecs:enable-execute-command ecs:propagate-tags ecs:task-cpu ecs:task-memory	Write
CreateExpressGatewayService	Grants permission to create a new Amazon ECS Express Gateway service with cluster and task definition	service*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys ecs:cluster ecs:enable-ecs-managed-tags ecs:propagate-tags ecs:ResourceTag/${TagKey} ecs:subnet ecs:task-cpu ecs:task-definition ecs:task-memory	Write
CreateService	Grants permission to run and maintain a desired number of tasks from a specified task definition via service creation	service*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys ecs:auto-assign-public-ip ecs:capacity-provider ecs:cluster ecs:enable-ebs-volumes ecs:enable-ecs-managed-tags ecs:enable-execute-command ecs:enable-service-connect ecs:enable-vpc-lattice ecs:namespace ecs:propagate-tags ecs:ResourceTag/${TagKey} ecs:subnet ecs:task-cpu ecs:task-definition ecs:task-memory	Write
CreateTaskSet	Grants permission to create a new Amazon ECS task set	task-set*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys ecs:capacity-provider ecs:cluster ecs:ResourceTag/${TagKey} ecs:service ecs:task-definition	Write
DeleteAccountSetting	Grants permission to modify the ARN and resource ID format of a resource for a specified IAM user, IAM role, or the root user for an account. You can specify whether the new ARN and resource ID format are disabled for new resources that are created		ecs:account-setting	Write
DeleteAttributes	Grants permission to delete one or more custom attributes from an Amazon ECS resource	container-instance*	aws:ResourceTag/${TagKey} ecs:cluster ecs:ResourceTag/${TagKey}	Write
DeleteCapacityProvider	Grants permission to delete the specified capacity provider	capacity-provider*	aws:ResourceTag/${TagKey} ecs:ResourceTag/${TagKey}	Write
DeleteCluster	Grants permission to delete the specified cluster	cluster*	aws:ResourceTag/${TagKey} ecs:ResourceTag/${TagKey}	Write
DeleteDaemon	Grants permission to delete a specified daemon within a cluster	daemon*	aws:ResourceTag/${TagKey} ecs:cluster	Write
DeleteDaemonTaskDefinition	Grants permission to delete the specified daemon task definition	daemon-task-definition*	aws:ResourceTag/${TagKey}	Write
DeleteExpressGatewayService	Grants permission to delete a specified Express Gateway service	service*	aws:ResourceTag/${TagKey} ecs:cluster ecs:ResourceTag/${TagKey}	Write
DeleteService	Grants permission to delete a specified service within a cluster	service*	aws:ResourceTag/${TagKey} ecs:cluster ecs:ResourceTag/${TagKey}	Write
DeleteTaskDefinitions	Grants permission to delete the specified task definitions by family and revision	task-definition*	aws:ResourceTag/${TagKey} ecs:ResourceTag/${TagKey}	Write
DeleteTaskSet	Grants permission to delete the specified task set	task-set*	aws:ResourceTag/${TagKey} ecs:cluster ecs:ResourceTag/${TagKey} ecs:service	Write
DeregisterContainerInstance	Grants permission to deregister an Amazon ECS container instance from the specified cluster	cluster*	aws:ResourceTag/${TagKey} ecs:ResourceTag/${TagKey}	Write
DeregisterTaskDefinition	Grants permission to deregister the specified task definition by family and revision			Write
DescribeCapacityProviders	Grants permission to describe one or more Amazon ECS capacity providers	capacity-provider*	aws:ResourceTag/${TagKey} ecs:ResourceTag/${TagKey}	Read
DescribeClusters	Grants permission to describes one or more of your clusters	cluster*	aws:ResourceTag/${TagKey} ecs:ResourceTag/${TagKey}	Read
DescribeContainerInstances	Grants permission to describes Amazon ECS container instances	container-instance*	aws:ResourceTag/${TagKey} ecs:cluster ecs:ResourceTag/${TagKey}	Read
DescribeDaemon	Grants permission to describe the specified daemon running in your cluster	daemon*	aws:ResourceTag/${TagKey} ecs:cluster	Read
DescribeDaemonDeployments	Grants permission to describe one or more of your daemon deployments	daemon*	aws:ResourceTag/${TagKey} ecs:cluster	Read
DescribeDaemonDeployments		daemon-deployment*	aws:ResourceTag/${TagKey} ecs:cluster ecs:daemon	Read
DescribeDaemonRevisions	Grants permission to describe one or more of your daemon revisions	daemon*	aws:ResourceTag/${TagKey} ecs:cluster	Read
DescribeDaemonRevisions		daemon-revision*	aws:ResourceTag/${TagKey} ecs:cluster ecs:daemon	Read
DescribeDaemonTaskDefinition	Grants permission to describe a daemon task definition	daemon-task-definition*	aws:ResourceTag/${TagKey}	Read
DescribeExpressGatewayService	Grants permission to describe the specified Express Gateway service	service*	aws:ResourceTag/${TagKey} ecs:cluster ecs:ResourceTag/${TagKey}	Read
DescribeServiceDeployments	Grants permission to describe one or more of your service deployments	service*	aws:ResourceTag/${TagKey} ecs:cluster ecs:ResourceTag/${TagKey}	Read
DescribeServiceDeployments		service-deployment*	aws:ResourceTag/${TagKey} ecs:cluster ecs:service	Read
DescribeServiceRevisions	Grants permission to describe one or more of your service revisions	service*	aws:ResourceTag/${TagKey} ecs:cluster ecs:ResourceTag/${TagKey}	Read
DescribeServiceRevisions		service-revision*	aws:ResourceTag/${TagKey} ecs:cluster ecs:service	Read
DescribeServices	Grants permission to describe the specified services running in your cluster	service*	aws:ResourceTag/${TagKey} ecs:cluster ecs:ResourceTag/${TagKey}	Read
DescribeTaskDefinition	Grants permission to describe a task definition. You can specify a family and revision to find information about a specific task definition, or you can simply specify the family to find the latest ACTIVE revision in that family			Read
DescribeTaskSets	Grants permission to describe Amazon ECS task sets	task-set*	aws:ResourceTag/${TagKey} ecs:cluster ecs:ResourceTag/${TagKey} ecs:service	Read
DescribeTasks	Grants permission to describe a specified task or tasks	task*	aws:ResourceTag/${TagKey} ecs:cluster ecs:ResourceTag/${TagKey}	Read
DiscoverPollEndpoint	Grants permission to get an endpoint for the Amazon ECS agent to poll for updates			Write
ExecuteCommand	Grants permission to run a command remotely on an Amazon ECS container	cluster*	aws:ResourceTag/${TagKey} ecs:cluster ecs:container-name ecs:ResourceTag/${TagKey} ecs:task	Write
ExecuteCommand		task*	aws:ResourceTag/${TagKey} ecs:cluster ecs:container-name ecs:ResourceTag/${TagKey} ecs:task	Write
GetTaskProtection	Grants permission to retrieve the protection status of tasks in an Amazon ECS service	task*	aws:ResourceTag/${TagKey} ecs:cluster ecs:ResourceTag/${TagKey}	Read
ListAccountSettings	Grants permission to list the account settings for an Amazon ECS resource for a specified principal			Read
ListAttributes	Grants permission to lists the attributes for Amazon ECS resources within a specified target type and cluster	cluster*	aws:ResourceTag/${TagKey} ecs:ResourceTag/${TagKey}	List
ListClusters	Grants permission to get a list of existing clusters			List
ListContainerInstances	Grants permission to get a list of container instances in a specified cluster	cluster*	aws:ResourceTag/${TagKey} ecs:ResourceTag/${TagKey}	List
ListDaemonDeployments	Grants permission to get a list of daemon deployments for a specified daemon	daemon*	aws:ResourceTag/${TagKey} ecs:cluster	List
ListDaemonTaskDefinitions	Grants permission to get a list of daemon task definitions that are registered to your account			List
ListDaemons	Grants permission to get a list of daemons that are running in a specified cluster		ecs:cluster	List
ListServiceDeployments	Grants permission to get a list of service deployments for a specified service	service*	aws:ResourceTag/${TagKey} ecs:cluster ecs:ResourceTag/${TagKey}	List
ListServices	Grants permission to get a list of services that are running in a specified cluster		ecs:cluster	List
ListServicesByNamespace	Grants permission to get a list of services that are running in a specified Amazon Web Services Cloud Map Namespace		ecs:namespace	List
ListTagsForResource	Grants permission to get a list of tags for the specified resource	capacity-provider	aws:ResourceTag/${TagKey} ecs:ResourceTag/${TagKey}	Read
		cluster	aws:ResourceTag/${TagKey} ecs:ResourceTag/${TagKey}
		container-instance	aws:ResourceTag/${TagKey} ecs:ResourceTag/${TagKey}
		service	aws:ResourceTag/${TagKey} ecs:ResourceTag/${TagKey}
		task	aws:ResourceTag/${TagKey} ecs:ResourceTag/${TagKey}
		task-definition	aws:ResourceTag/${TagKey} ecs:ResourceTag/${TagKey}
		task-set	aws:ResourceTag/${TagKey} ecs:ResourceTag/${TagKey}
ListTaskDefinitionFamilies	Grants permission to get a list of task definition families that are registered to your account (which may include task definition families that no longer have any ACTIVE task definitions)			List
ListTaskDefinitions	Grants permission to get a list of task definitions that are registered to your account			List
ListTasks	Grants permission to get a list of tasks for a specified cluster	container-instance*	aws:ResourceTag/${TagKey} ecs:cluster ecs:ResourceTag/${TagKey}	List
PutAccountSetting	Grants permission to modify the ARN and resource ID format of a resource for a specified IAM user, IAM role, or the root user for an account. You can specify whether the new ARN and resource ID format are enabled for new resources that are created. Enabling this setting is required to use new Amazon ECS features such as resource tagging		ecs:account-setting	Write
PutAccountSettingDefault	Grants permission to modify the ARN and resource ID format of a resource type for all IAM users on an account for which no individual account setting has been set. Enabling this setting is required to use new Amazon ECS features such as resource tagging		ecs:account-setting	Write
PutAttributes	Grants permission to create or update an attribute on an Amazon ECS resource	container-instance*	aws:ResourceTag/${TagKey} ecs:cluster ecs:ResourceTag/${TagKey}	Write
PutClusterCapacityProviders	Grants permission to modify the available capacity providers and the default capacity provider strategy for a cluster	cluster*	aws:ResourceTag/${TagKey} ecs:capacity-provider ecs:ResourceTag/${TagKey}	Write
RegisterContainerInstance	Grants permission to register an EC2 instance into the specified cluster	cluster*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys ecs:ResourceTag/${TagKey}	Write
RegisterDaemonTaskDefinition	Grants permission to register a new daemon task definition from the supplied family and containerDefinitions	daemon-task-definition*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys ecs:privileged ecs:task-cpu ecs:task-memory	Write
RegisterTaskDefinition	Grants permission to register a new task definition from the supplied family and containerDefinitions	task-definition*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys ecs:compute-compatibility ecs:privileged ecs:ResourceTag/${TagKey} ecs:task-cpu ecs:task-memory	Write
RunTask	Grants permission to start a task using random placement and the default Amazon ECS scheduler	task-definition*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys ecs:capacity-provider ecs:cluster ecs:enable-ebs-volumes ecs:enable-execute-command ecs:ResourceTag/${TagKey}	Write
StartTask	Grants permission to start a new task from the specified task definition on the specified container instance or instances	task-definition*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys ecs:cluster ecs:container-instances ecs:enable-ebs-volumes ecs:enable-execute-command ecs:ResourceTag/${TagKey}	Write
StopServiceDeployment	Grants permission to stop an ongoing service deployment	service*	aws:ResourceTag/${TagKey} ecs:cluster ecs:ResourceTag/${TagKey}	Write
StopServiceDeployment	Grants permission to stop an ongoing service deployment	service-deployment*	aws:ResourceTag/${TagKey} ecs:cluster ecs:service	Write
StopTask	Grants permission to stop a running task	task*	aws:ResourceTag/${TagKey} ecs:cluster ecs:ResourceTag/${TagKey}	Write
SubmitAttachmentStateChanges	Grants permission to send an acknowledgement that attachments changed states	cluster*	aws:ResourceTag/${TagKey} ecs:ResourceTag/${TagKey}	Write
SubmitContainerStateChange	Grants permission to send an acknowledgement that a container changed states	cluster*	aws:ResourceTag/${TagKey} ecs:ResourceTag/${TagKey}	Write
SubmitTaskStateChange	Grants permission to send an acknowledgement that a task changed states	cluster*	aws:ResourceTag/${TagKey} ecs:ResourceTag/${TagKey}	Write
TagResource	Grants permission to tag the specified resource	capacity-provider	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys ecs:CreateAction ecs:ResourceTag/${TagKey}	Tagging, Write
		cluster	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys ecs:CreateAction ecs:ResourceTag/${TagKey}
		container-instance	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys ecs:CreateAction ecs:ResourceTag/${TagKey}
		daemon	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys ecs:cluster ecs:CreateAction
		daemon-task-definition	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys ecs:CreateAction
		service	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys ecs:CreateAction ecs:ResourceTag/${TagKey}
		task	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys ecs:CreateAction ecs:ResourceTag/${TagKey}
		task-definition	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys ecs:CreateAction ecs:ResourceTag/${TagKey}
		task-set	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys ecs:CreateAction ecs:ResourceTag/${TagKey}
UntagResource	Grants permission to untag the specified resource	capacity-provider	aws:ResourceTag/${TagKey} aws:TagKeys ecs:ResourceTag/${TagKey}	Tagging, Write
		cluster	aws:ResourceTag/${TagKey} aws:TagKeys ecs:ResourceTag/${TagKey}
		container-instance	aws:ResourceTag/${TagKey} aws:TagKeys ecs:ResourceTag/${TagKey}
		daemon	aws:ResourceTag/${TagKey} aws:TagKeys ecs:cluster
		daemon-task-definition	aws:ResourceTag/${TagKey} aws:TagKeys
		service	aws:ResourceTag/${TagKey} aws:TagKeys ecs:ResourceTag/${TagKey}
		task	aws:ResourceTag/${TagKey} aws:TagKeys ecs:ResourceTag/${TagKey}
		task-definition	aws:ResourceTag/${TagKey} aws:TagKeys ecs:ResourceTag/${TagKey}
		task-set	aws:ResourceTag/${TagKey} aws:TagKeys ecs:ResourceTag/${TagKey}
UpdateCapacityProvider	Grants permission to update the specified capacity provider	capacity-provider*	aws:ResourceTag/${TagKey} ecs:instance-metadata-tags-propagation ecs:propagate-tags ecs:ResourceTag/${TagKey}	Write
UpdateCluster	Grants permission to modify the configuration or settings to use for a cluster	cluster*	aws:ResourceTag/${TagKey} ecs:fargate-ephemeral-storage-kms-key ecs:ResourceTag/${TagKey}	Write
UpdateClusterSettings	Grants permission to modify the settings to use for a cluster	cluster*	aws:ResourceTag/${TagKey} ecs:ResourceTag/${TagKey}	Write
UpdateContainerAgent	Grants permission to update the Amazon ECS container agent on a specified container instance	container-instance*	aws:ResourceTag/${TagKey} ecs:cluster ecs:ResourceTag/${TagKey}	Write
UpdateContainerInstancesState	Grants permission to the user to modify the status of an Amazon ECS container instance	container-instance*	aws:ResourceTag/${TagKey} ecs:cluster ecs:ResourceTag/${TagKey}	Write
UpdateDaemon	Grants permission to modify the parameters of a daemon	daemon*	aws:ResourceTag/${TagKey} ecs:capacity-provider ecs:cluster ecs:daemon-task-definition ecs:enable-ecs-managed-tags ecs:enable-execute-command ecs:propagate-tags ecs:task-cpu ecs:task-memory	Write
UpdateExpressGatewayService	Grants permission to modify the parameters of an Express Gateway service	service*	aws:ResourceTag/${TagKey} ecs:cluster ecs:enable-ecs-managed-tags ecs:propagate-tags ecs:ResourceTag/${TagKey} ecs:subnet ecs:task-cpu ecs:task-definition ecs:task-memory	Write
UpdateService	Grants permission to modify the parameters of a service	service*	aws:ResourceTag/${TagKey} ecs:auto-assign-public-ip ecs:capacity-provider ecs:cluster ecs:enable-ebs-volumes ecs:enable-ecs-managed-tags ecs:enable-execute-command ecs:enable-service-connect ecs:enable-vpc-lattice ecs:namespace ecs:propagate-tags ecs:ResourceTag/${TagKey} ecs:subnet ecs:task-cpu ecs:task-definition ecs:task-memory	Write
UpdateServicePrimaryTaskSet	Grants permission to modify the primary task set used in a service	service*	aws:ResourceTag/${TagKey} ecs:cluster ecs:ResourceTag/${TagKey}	Write
UpdateTaskProtection	Grants permission to modify the protection status of a task	task*	aws:ResourceTag/${TagKey} ecs:cluster ecs:ResourceTag/${TagKey}	Write
UpdateTaskSet	Grants permission to update the specified task set	task-set*	aws:ResourceTag/${TagKey} ecs:cluster ecs:ResourceTag/${TagKey} ecs:service	Write

Permission-only actions for Amazon Elastic Container Service

The following actions are defined by Amazon Elastic Container Service but are not directly invocable through any API operation. They can only be used in IAM policy statements to grant or deny permissions.

Actions	Description	Resource types (*required)	Condition keys	Access level
AllowVendedLogDeliveryForResource	Grants permission to allow vended log delivery for a specified resource	cluster	aws:ResourceTag/${TagKey} ecs:ResourceTag/${TagKey}	Permissions management, Write
Poll	Grants permission to an agent to connect with the Amazon ECS service to report status and get commands	container-instance*	aws:ResourceTag/${TagKey} ecs:cluster ecs:ResourceTag/${TagKey}	Write
PutSystemLogEvents	Grants permission to collect system logs from the container instances	cluster*	aws:ResourceTag/${TagKey} ecs:ResourceTag/${TagKey}	Write
PutSystemLogEvents		container-instance*	aws:ResourceTag/${TagKey} ecs:capacity-provider ecs:cluster ecs:ResourceTag/${TagKey}	Write
StartTelemetrySession	Grants permission to start a telemetry session	container-instance*	aws:ResourceTag/${TagKey} ecs:cluster ecs:ResourceTag/${TagKey}	Write

Resource types defined by Amazon Elastic Container Service

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
capacity-provider	arn:${Partition}:ecs:${Region}:${Account}:capacity-provider/${CapacityProviderName}	aws:ResourceTag/${TagKey} ecs:ResourceTag/${TagKey}
cluster	arn:${Partition}:ecs:${Region}:${Account}:cluster/${ClusterName}	aws:ResourceTag/${TagKey} ecs:ResourceTag/${TagKey}
container-instance	arn:${Partition}:ecs:${Region}:${Account}:container-instance/${ClusterName}/${ContainerInstanceId}	aws:ResourceTag/${TagKey} ecs:ResourceTag/${TagKey}
daemon	arn:${Partition}:ecs:${Region}:${Account}:daemon/${ClusterName}/${DaemonName}	aws:ResourceTag/${TagKey} ecs:cluster
daemon-deployment	arn:${Partition}:ecs:${Region}:${Account}:daemon-deployment/${ClusterName}/${DaemonName}/${DaemonDeploymentId}	aws:ResourceTag/${TagKey} ecs:cluster ecs:daemon
daemon-revision	arn:${Partition}:ecs:${Region}:${Account}:daemon-revision/${ClusterName}/${DaemonName}/${DaemonRevisionId}	aws:ResourceTag/${TagKey} ecs:cluster ecs:daemon
daemon-task-definition	arn:${Partition}:ecs:${Region}:${Account}:daemon-task-definition/${DaemonTaskDefinitionFamilyName}:${DaemonTaskDefinitionRevisionNumber}	aws:ResourceTag/${TagKey}
service	arn:${Partition}:ecs:${Region}:${Account}:service/${ClusterName}/${ServiceName}	aws:ResourceTag/${TagKey} ecs:ResourceTag/${TagKey}
service-deployment	arn:${Partition}:ecs:${Region}:${Account}:service-deployment/${ClusterName}/${ServiceName}/${ServiceDeploymentId}	aws:ResourceTag/${TagKey} ecs:cluster ecs:service
service-revision	arn:${Partition}:ecs:${Region}:${Account}:service-revision/${ClusterName}/${ServiceName}/${ServiceRevisionId}	aws:ResourceTag/${TagKey} ecs:cluster ecs:service
task	arn:${Partition}:ecs:${Region}:${Account}:task/${ClusterName}/${TaskId}	aws:ResourceTag/${TagKey} ecs:ResourceTag/${TagKey}
task-definition	arn:${Partition}:ecs:${Region}:${Account}:task-definition/${TaskDefinitionFamilyName}:${TaskDefinitionRevisionNumber}	aws:ResourceTag/${TagKey} ecs:ResourceTag/${TagKey}
task-set	arn:${Partition}:ecs:${Region}:${Account}:task-set/${ClusterName}/${ServiceName}/${TaskSetId}	aws:ResourceTag/${TagKey} ecs:ResourceTag/${TagKey}

Condition keys for Amazon Elastic Container Service

Amazon Elastic Container Service defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access by the tags that are passed in the request	String
aws:ResourceTag/${TagKey}	Filters access by the tag key-value pairs attached to the resource	String
aws:TagKeys	Filters access by the tag keys that are passed in the request	ArrayOfString
ecs:CreateAction	Filters access by the name of a resource-creating API action	String
ecs:ResourceTag/${TagKey}	Filters access by the tag key-value pairs attached to the resource	String
ecs:account-setting	Filters access by the Amazon ECS account setting name	String
ecs:auto-assign-public-ip	Filters access by the public IP assignment configuration of your Amazon ECS task or Amazon ECS service that uses awsvpc network mode	Bool
ecs:capacity-provider	Filters access by the ARN of an Amazon ECS capacity provider	ArrayOfARN
ecs:cluster	Filters access by the ARN of an Amazon ECS cluster	ARN
ecs:compute-compatibility	Filters access by the required compatibilities field provided in the request	ArrayOfString
ecs:container-instances	Filters access by the ARN of an Amazon ECS container instance	ARN
ecs:container-name	Filters access by the name of an Amazon ECS container which is defined in the ECS task definition	String
ecs:daemon	Filters access by the ARN of an Amazon ECS daemon	ARN
ecs:daemon-task-definition	Filters access by the ARN of an Amazon ECS daemon task definition	ARN
ecs:enable-ebs-volumes	Filters access by the Amazon ECS managed Amazon EBS volume capability of your ECS task or service	String
ecs:enable-ecs-managed-tags	Filters access by the enableECSManagedTags configuration of your Amazon ECS task or Amazon ECS service	Bool
ecs:enable-execute-command	Filters access by the execute-command capability of your Amazon ECS task or Amazon ECS service	String
ecs:enable-service-connect	Filters access by the enable field value in the Service Connect configuration	String
ecs:enable-vpc-lattice	Filters access by the VPC lattice capability of your Amazon ECS service	String
ecs:fargate-ephemeral-storage-kms-key	Filters access by the Amazon KMS key id provided in the request	String
ecs:gateway	Filters access by the ARN of an Amazon ECS gateway	ARN
ecs:instance-metadata-tags-propagation	Filters access by the instance metadata tags propagation setting of your Amazon ECS capacity provider	Bool
ecs:namespace	Filters access by the ARN of Amazon Web Services Cloud Map namespace which is defined in the Service Connect Configuration	ARN
ecs:privileged	Filters access by the privileged field provided in the request	String
ecs:propagate-tags	Filters access by the tag propagation configuration of your Amazon ECS task or Amazon ECS service	String
ecs:service	Filters access by the ARN of an Amazon ECS service	ARN
ecs:subnet	Filters access by the subnet configuration of your Amazon ECS task or Amazon ECS service that uses awsvpc network mode	ArrayOfString
ecs:task	Filters access by the ARN of an Amazon ECS task	ARN
ecs:task-cpu	Filters access by the task cpu, as an integer with 1024 = 1 vCPU, provided in the request	Numeric
ecs:task-definition	Filters access by the ARN of an Amazon ECS task definition	ARN
ecs:task-memory	Filters access by the task memory, as an integer representing MiB, provided in the request	Numeric

Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Amazon Elastic Container Registry (ecr)

Amazon Elastic File System (elasticfilesystem)