title: Unable to assume role and validate the specified targetGroupArn. Please verify that the ECS service role being passed has the proper permissions
body: <p>I am trying to create a cluster, service and task. The error occurs in <code>Myservice</code> as it says <code>Unable to assume role and validate the specified targetGroupArn. Please verify that the ECS service role being passed has the proper permissions.</code> What am I doing wrong? I haven't attached all associated files, I have just provided the yml file where I think the error occurs.<br />
  role.yml</p>
  <pre><code>---
  AWSTemplateFormatVersion: 2010-09-09 
  Resources:
  
    ExRole:
        Type: 'AWS::IAM::Role'
        Properties:
          AssumeRolePolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Principal:
                  Service:
                    - ecs-tasks.amazonaws.com
                Action:
                  - 'sts:AssumeRole'
          Path: /
          ManagedPolicyArns:
            - arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy
          Policies: 
            - PolicyName: AccessECR
              PolicyDocument:
                Version: '2012-10-17'
                Statement:
                  - Effect: Allow
                    Action: 
                      - ecr:BatchGetImage
                      - ecr:GetAuthorizationToken
                      - ecr:GetDownloadUrlForLayer 
                    Resource: '*'
  
    ContainerInstanceRole:
      Type: AWS::IAM::Role
      Properties:
        AssumeRolePolicyDocument:
          Version: '2012-10-17'               
          Statement:
            - Effect: Allow
              Principal: 
                  Service: 
                      - ec2.amazonaws.com
              Action: 
                  - sts:AssumeRole
        ManagedPolicyArns:
          - arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceforEC2Role
        Path: '/'
  
    InstanceProfile:
      Type: AWS::IAM::InstanceProfile
      Properties: 
        Roles: 
          - !Ref ContainerInstanceRole      
  
  Outputs:
    
    ExRole:
      Description: Task excution role
      Value: !Ref ExRole
      Export:
          Name: &quot;ExRole&quot;
    InstanceProfile:
      Description: profile for container instances
      Value: !Ref InstanceProfile
      Export:
          Name: &quot;InstanceProfile&quot;            
  </code></pre>
  <p>Clusterandservice.yml</p>
  <pre><code>---
  AWSTemplateFormatVersion: 2010-09-09
  
  Parameters:
  
    KeyName:
      Type: AWS::EC2::KeyPair::KeyName
      Default: wahaj(webserver)
  
    DesiredCapacity:
      Type: Number
      Default: 2
  
    MinSize:
      Type: Number
      Default: 1
  
    MaxSize:
      Type: Number
      Default: 4  
  
    InstanceProfile:
      Type: String
  
    DefaultTargetGroup:
      Type: String
  
    Task:
      Type: String
  
    Albsg:
      Type: String
  
    VpcID:
      Type: String
  
    SubnetA:
      Type: String
        
    SubnetB:
      Type: String
  
  
  Resources:
  
    MyCluster:
        Type: AWS::ECS::Cluster
        Properties: {}
  
    wahajwebserver:
      Type: AWS::EC2::SecurityGroup
      Properties:
        GroupName: wahaj-webserver
        SecurityGroupIngress:
          - IpProtocol: tcp
            FromPort: 22
            ToPort: 22
            CidrIp: 0.0.0.0/0
          - IpProtocol: tcp
            FromPort: 0
            ToPort: 65535
            SourceSecurityGroupId: !Ref Albsg
            Description: For traffic from Internet
        GroupDescription: Security Group for demo server
        VpcId: !Ref VpcID
  
    Myservice:
        Type: AWS::ECS::Service
        Properties: 
            Cluster: !Ref MyCluster        
            DeploymentController:   
                Type: ECS
            DesiredCount: 2
            LaunchType: EC2
            LoadBalancers: 
                - ContainerName: python
                  ContainerPort: 8080
                  TargetGroupArn: !Ref DefaultTargetGroup
            Role: !Ref InstanceProfile
            SchedulingStrategy: REPLICA
            ServiceName: Python-service
            TaskDefinition: !Ref Task
  
    ec2instance:
      Type: AWS::AutoScaling::LaunchConfiguration
      Properties:
        UserData:
          Fn::Base64: !Sub |
            #!/bin/bash -xe
  
            yum update -y &amp;&amp; yum install -y aws-cfn-bootstrap 
  
            echo ECS_CLUSTER=${MyCluster} &gt;&gt; /etc/ecs/ecs.config
            echo ECS_BACKEND_HOST= &gt;&gt; /etc/ecs/ecs.config           
  
            /opt/aws/bin/cfn-signal -e $? \
                  --stack ${AWS::StackName} \
                  --resource myASG 
                  --region ${AWS::Region}
  
        BlockDeviceMappings:
          - DeviceName: /dev/xvda
            Ebs:
              DeleteOnTermination: &quot;true&quot;
              VolumeSize: 30
              VolumeType: gp2
        ImageId: ami-06e05a843071324d1 
        InstanceType: t2.small
        IamInstanceProfile: !Ref InstanceProfile
        KeyName: !Ref KeyName
        SecurityGroups:
            - Ref: wahajwebserver
  
    myASG:
      Type: AWS::AutoScaling::AutoScalingGroup
      CreationPolicy:
        ResourceSignal:
          Timeout: PT5M
          Count: !Ref DesiredCapacity
      Properties:
        #AutoScalingGroupName: myASG
        MinSize: !Ref MinSize
        MaxSize: !Ref MaxSize
        DesiredCapacity: !Ref DesiredCapacity
        HealthCheckGracePeriod: 300
        LaunchConfigurationName:
          Ref: ec2instance
        VPCZoneIdentifier:
          - !Ref SubnetA
          - !Ref SubnetB
        TargetGroupARNs:
          - !Ref DefaultTargetGroup
  </code></pre>