title: How do I change my IAM ECSTaskExecutionRole to give me permission to get parameters from Systems Manager - Parameter Store?
body: <p>I want to pass secrets or sensitive information securely to containers in a task for Amazon Elastic Container Service (Amazon ECS). I have a Docker container on ECS and a Task Definition that pulls environment variables from Systems Parameter Store. However, when I run my task in ECS, I get the following error message when I try to run my container.</p>
  <blockquote>
  <p>STOPPED (Fetching secret data from SSM Parameter Store in us-east-2:
  AccessDeniedException: User:
  arn:was:sts::&lt;my_account_id&gt;:assumed-role/ecsTaskExecutionRole/2c0dfb5f086da28abc753c07b6de728 is not authorized to perform: ssm:GetParameters on resource:
  arn:was:ssm:us-east-2:&lt;my_account_id&gt;:parameter/&lt;MY_PARAMETER&gt; status
  code: 400, request id: &lt;request_id&gt;</p>
  </blockquote>
  <p><a href="https://gyazo.com/5a3dd8c06da3614d19b8bc725e572f2c" rel="nofollow noreferrer">https://gyazo.com/5a3dd8c06da3614d19b8bc725e572f2c</a></p>
  <p>I followed this article on passing sensitive information to containers in an ECS task.</p>
  <p><a href="https://aws.amazon.com/premiumsupport/knowledge-center/ecs-data-security-container-task/" rel="nofollow noreferrer">https://aws.amazon.com/premiumsupport/knowledge-center/ecs-data-security-container-task/</a></p>
  <p>Per the article, I went into IAM and added the following in-line policy to my ecsTaskExecutionRole.</p>
  <pre><code>{
      &quot;Version&quot;: &quot;2012-10-17&quot;,
      &quot;Statement&quot;: [
          {
              &quot;Sid&quot;: &quot;VisualEditor0&quot;,
              &quot;Effect&quot;: &quot;Allow&quot;,
              &quot;Action&quot;: [
                  &quot;secretsmanager:GetSecretValue&quot;,
                  &quot;ssm:GetParameters&quot;
              ],
              &quot;Resource&quot;: [
                  &quot;arn:aws:secretsmanager:&lt;my_region&gt;:&lt;my_account_id&gt;:secret:SLACK_API_TOKEN*&quot;,
                  &quot;arn:aws:secretsmanager:&lt;my_region&gt;:&lt;my_account_id&gt;:secret:DB_USER*&quot;,
                  &quot;arn:aws:secretsmanager:&lt;my_region&gt;:&lt;my_account_id&gt;:secret:DB_PASSWORD*&quot;,
                  &quot;arn:aws:secretsmanager:&lt;my_region&gt;:&lt;my_account_id&gt;:secret:DB_HOST*&quot;,
                  &quot;arn:aws:secretsmanager:&lt;my_region&gt;:&lt;my_account_id&gt;:secret:DB_DATABASE_NAME*&quot;,
                  &quot;arn:aws:ssm:&lt;my_region&gt;:&lt;my_account_id&gt;:parameter/SLACK_API_TOKEN&quot;,
                  &quot;arn:aws:ssm:&lt;my_region&gt;:&lt;my_account_id&gt;:parameter/DB_USER&quot;,
                  &quot;arn:aws:ssm:&lt;my_region&gt;:&lt;my_account_id&gt;:parameter/DB_PASSWORD&quot;,
                  &quot;arn:aws:ssm:&lt;my_region&gt;:&lt;my_account_id&gt;:parameter/DB_HOST&quot;,
                  &quot;arn:aws:ssm:&lt;my_region&gt;:&lt;my_account_id&gt;:parameter/DB_DATABASE_NAME&quot;,
              ]
          }
      ]
  }
  </code></pre>
  <p>I also have an AWS Managed Policy that looks like this under the same ecsTaskExecutionRole.</p>
  <pre><code>{
      &quot;Version&quot;: &quot;2012-10-17&quot;,
      &quot;Statement&quot;: [
          {
              &quot;Effect&quot;: &quot;Allow&quot;,
              &quot;Action&quot;: [
                  &quot;ecr:GetAuthorizationToken&quot;,
                  &quot;ecr:BatchCheckLayerAvailability&quot;,
                  &quot;ecr:GetDownloadUrlForLayer&quot;,
                  &quot;ecr:BatchGetImage&quot;,
                  &quot;logs:CreateLogStream&quot;,
                  &quot;logs:PutLogEvents&quot;
              ],
              &quot;Resource&quot;: &quot;*&quot;
          }
      ]
  }
  </code></pre>
  <p>The full IAM role for ecsTaskExecutionRole looks like this:</p>
  <p><a href="https://gyazo.com/b28a4ae1beca4db31228298767685fe2" rel="nofollow noreferrer">https://gyazo.com/b28a4ae1beca4db31228298767685fe2</a></p>
  <p>The keys in the Parameter Store are stored as Secret Strings. I'm not using my own keys and just using whatever the default one is for my account.</p>