How to allow an IAM entity to create the AWSServiceRoleForECS service-linked role

Question

How do I allow an IAM entity to create the AWSServiceRoleForECS service-linked role?

Answer 1

Hey @Meer,

Add the following statement to the permissions policy for the IAM entity that needs to create the service-linked role:

{
    "Effect": "Allow",
    "Action": [
        "iam:CreateServiceLinkedRole",
        "iam:PutRolePolicy"
    ],
    "Resource": "arn:aws:iam::*:role/aws-service-role/ecs.amazonaws.com/AWSServiceRoleForECS*",
    "Condition": {"StringLike": {"iam:AWSServiceName": "ecs.amazonaws.com"}}
}