title: Allow ECS task to AssumeRole into another account
body: <p>I've looked at <a href="https://stackoverflow.com/questions/59726145/how-do-i-have-an-ecs-task-assume-a-role-from-another-aws-account">this question</a> and <a href="https://stackoverflow.com/questions/63694971/cant-grant-cross-account-access-to-a-ecs-tasks-role">this one</a> but I'm not able to deploy a role into a child account which allows an ECS task running in the parent account to AssumeRole into it.</p>
  <p>Terraform code:</p>
  <pre class="lang-hcl prettyprint-override"><code>data &quot;aws_iam_policy_document&quot; &quot;cross-account-assume-role-child&quot; {
    statement {
      actions = [&quot;sts:AssumeRole&quot;]
      principals {
        type        = &quot;AWS&quot;
        identifiers = [
          &quot;arn:aws:sts::${var.master_account_ID}:assumed-role/${var.cross_account_role_name}&quot;
        ]
      }
    }
  }
  
  </code></pre>
  <p>When I try to run terraform the plan succeeds but the apply fails with such an error:</p>
  <pre><code>Error: failed creating IAM Role (ECS-cross-account-child-role): 
  MalformedPolicyDocument: Invalid principal in policy: 
  &quot;AWS&quot;:&quot;arn:aws:sts::&lt;AWS Account ID&gt;:assumed-role/ECS-cross-account-master-role&quot;
  
  </code></pre>
  <p>I get the same error if I try to manually update the policy like above in the AWS console so this isn't due to terraform.</p>
  <p>What am I doing wrong?</p>