Difference between task role and execution role in AWS ECS

I'm Zin Lin Htet. Who love to learn and share about Linux, Cloud, Docker and K8s. Currently working as a DevOps Engineer at one of the famous Fintech Company in Myanmar.
Search for a command to run...

I'm Zin Lin Htet. Who love to learn and share about Linux, Cloud, Docker and K8s. Currently working as a DevOps Engineer at one of the famous Fintech Company in Myanmar.
No comments yet. Be the first to comment.
Today, I want to introduce Dozzle, a web-based tool for viewing container logs in real time. In this tutorial, I utilized AWS Lightsail with Ubuntu to host the Docker engine. I used a Cloudflare domai

Building a secure, scalable containerized application on AWS using ECS Fargate, RDS PostgreSQL, and GitHub Actions CI/CD

Today, we will learn how to set up a backend API container with PostgreSQL on Kubernetes. In this tutorial, you will learn how to write a multi-stage Docker file, install the MetalLB load balancer, set up the Rancher local path provisioner for storag...

Today I would like to share how to configure GitHub Actions OIDC with AWS. In this lab, you will learn why we use OIDC for AWS. Traditionally, we use an AWS Access Key ID and Secret Access Key as the authentication method to communicate with AWS serv...

Today, I want to explain the difference between a task role and an execution role in AWS ECS. Yesterday, I set up AWS ECS for a UAT environment and defined both roles. Let me clarify what a task role and an execution role are, when they are needed, and who uses them.
In my setup, my container needs to access ECR for pulling Docker images and needs to send logs to CloudWatch. My container needs to retrieve the DB password from AWS Secrets Manager. If I didn't define this execution role, my container couldn't pull images from ECR, send logs to CloudWatch, or retrieve the password from AWS Secrets Manager. This task execution role is performed before your container enters the running state.
Who use it?
The ECS agent uses it, not your application code.
When is it used?
Before container even starts running.
What is it for?
Pull images from Amazon Elastic Container Registry (ECR)
Send container logs to Amazon CloudWatch
Retrieve secrets from AWS Secrets Manager
Retrieve parameters from AWS Systems Manager
My application code (business logic) needs to upload PDF files to AWS S3, store tracking info in Amazon DynamoDB, and push notifications from Amazon SNS. The ECS task role is not used by the ECS agent, this role is only used by your application code inside the container. If the task role is miss your application is run but can't access AWS API calls.
Who use it?
My application code inside the container.
When is it used?
After the container start running.
What is it for?
To allow my application to access AWS services.
Examples:
Read/write to Amazon S3
Send messages to Amazon Simple Queue Service
Publish to Amazon Simple Notification Service
Access Amazon DynamoDB
Call other AWS APIs
I hope you understand the difference between a task role and an execution role in AWS ECS.