AmazonECS_FullAccess

Summary

Provides administrative access to Amazon ECS resources and enables ECS features through access to other AWS service resources, including VPCs, Auto Scaling groups and CloudFormation stacks. The Amazon ECS Developer Guide says it allows access to all Amazon ECS features available in the AWS Management Console.

Permissions imported from the AWS Managed Policy Reference Guide; other sections reviewed against the listed AWS sources.

Identity

ARN

arn:aws:iam::aws:policy/AmazonECS_FullAccessCopy ARN

Default version

v22

Created

2017-11-07

Last edited

2026-09-02

Services

application-autoscaling, appmesh, autoscaling, cloudformation, cloudwatch, codedeploy, ec2, ecs, elasticfilesystem, elasticloadbalancing, events, fsx, iam, lambda, logs, route53, servicediscovery, sns, ssm

Control-plane actions (440)

By access level: 259 List, 1 Permissions management, 56 Read, 5 Tagging, 119 Write.

Data-plane actions (1)

By access level: 1 Read.

Excluded and conditional actions

No patterns are excluded by NotAction or Deny statements.

Resource scope and attachment

Resource scope across granted actions: mixed.

Can be attached: Yes, to users, groups and roles.

Why this tier

• Grants at least 80% of the write and permissions-management actions of: ecs (55 of 55).
• Grants iam:PassRole, but only for scoped roles or under conditions (for example iam:PassedToService).

Guidance

Related policies

Same service

• AdministratorAccess-AWSElasticBeanstalk
• AIDevOpsReleaseManagementVPCPolicy
• AmazonAppStreamFullAccess
• AmazonAppStreamServiceAccess
• AmazonBioDiscoveryServiceLinkedRolePolicy
• AmazonDataZoneEnvironmentRolePermissionsBoundary
• AmazonDataZoneProjectDeploymentPermissionsBoundary
• AmazonDataZoneProjectRolePermissionsBoundary

Same domain

• AmazonBraketJobsExecutionPolicy
• AmazonDMSVPCManagementRole
• AmazonDRSVPCManagement
• AmazonEBSCSIDriverEKSClusterScopedPolicy
• AmazonEBSCSIDriverPolicy
• AmazonEBSCSIDriverPolicyV2
• AmazonEC2ContainerServiceRole
• AmazonEC2FullAccess

Frequently asked questions

When should I attach AmazonECS_FullAccess?

The Amazon ECS Developer Guide says you can attach it to your IAM identities, and that it grants administrative access to Amazon ECS and access to the services Amazon ECS is integrated with, for all Amazon ECS features available in the console. Attach it where that scope is intended.

What does AmazonECS_FullAccess grant?

It allows ecs:* and a long list of actions for Application Auto Scaling, App Mesh, Auto Scaling, CloudFormation, CloudWatch, CodeDeploy, EC2, Elastic Load Balancing, EventBridge, Route 53, AWS Cloud Map and CloudWatch Logs on all resources, plus scoped SSM reads, tagged network resource deletion, service-linked role creation and iam:PassRole.

What are the security risks of AmazonECS_FullAccess?

It can launch EC2 instances, create and delete VPCs and CloudFormation stacks, and pass any role to ECS tasks, all on Resource "*" or with a broad condition. The IAM User Guide warns against letting a user pass a role that has more permissions than you want the user to have. AWS managed policies don't grant least privilege permissions, and you must consider the security risk of granting principals more permissions than they need. AWS updates to the policy affect every identity it is attached to.

Policy JSON

Download policy.json

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ECSIntegrationsManagementPolicy",
      "Effect": "Allow",
      "Action": [
        "application-autoscaling:DeleteScalingPolicy",
        "application-autoscaling:DeregisterScalableTarget",
        "application-autoscaling:DescribeScalableTargets",
        "application-autoscaling:DescribeScalingActivities",
        "application-autoscaling:DescribeScalingPolicies",
        "application-autoscaling:PutScalingPolicy",
        "application-autoscaling:RegisterScalableTarget",
        "appmesh:DescribeVirtualGateway",
        "appmesh:DescribeVirtualNode",
        "appmesh:ListMeshes",
        "appmesh:ListVirtualGateways",
        "appmesh:ListVirtualNodes",
        "autoscaling:CreateAutoScalingGroup",
        "autoscaling:CreateLaunchConfiguration",
        "autoscaling:DeleteAutoScalingGroup",
        "autoscaling:DeleteLaunchConfiguration",
        "autoscaling:Describe*",
        "autoscaling:UpdateAutoScalingGroup",
        "cloudformation:CreateStack",
        "cloudformation:DeleteStack",
        "cloudformation:DescribeStack*",
        "cloudformation:UpdateStack",
        "cloudwatch:DeleteAlarms",
        "cloudwatch:DescribeAlarms",
        "cloudwatch:GetMetricStatistics",
        "cloudwatch:PutMetricAlarm",
        "codedeploy:BatchGetApplicationRevisions",
        "codedeploy:BatchGetApplications",
        "codedeploy:BatchGetDeploymentGroups",
        "codedeploy:BatchGetDeployments",
        "codedeploy:ContinueDeployment",
        "codedeploy:CreateApplication",
        "codedeploy:CreateDeployment",
        "codedeploy:CreateDeploymentGroup",
        "codedeploy:GetApplication",
        "codedeploy:GetApplicationRevision",
        "codedeploy:GetDeployment",
        "codedeploy:GetDeploymentConfig",
        "codedeploy:GetDeploymentGroup",
        "codedeploy:GetDeploymentTarget",
        "codedeploy:ListApplicationRevisions",
        "codedeploy:ListApplications",
        "codedeploy:ListDeploymentConfigs",
        "codedeploy:ListDeploymentGroups",
        "codedeploy:ListDeployments",
        "codedeploy:ListDeploymentTargets",
        "codedeploy:RegisterApplicationRevision",
        "codedeploy:StopDeployment",
        "ec2:AssociateRouteTable",
        "ec2:AttachInternetGateway",
        "ec2:AuthorizeSecurityGroupIngress",
        "ec2:CancelSpotFleetRequests",
        "ec2:CreateInternetGateway",
        "ec2:CreateLaunchTemplate",
        "ec2:CreateRoute",
        "ec2:CreateRouteTable",
        "ec2:CreateSecurityGroup",
        "ec2:CreateSubnet",
        "ec2:CreateVpc",
        "ec2:DeleteLaunchTemplate",
        "ec2:DeleteSubnet",
        "ec2:DeleteVpc",
        "ec2:Describe*",
        "ec2:DetachInternetGateway",
        "ec2:DisassociateRouteTable",
        "ec2:ModifySubnetAttribute",
        "ec2:ModifyVpcAttribute",
        "ec2:RequestSpotFleet",
        "ec2:RunInstances",
        "ecs:*",
        "elasticfilesystem:DescribeAccessPoints",
        "elasticfilesystem:DescribeFileSystems",
        "elasticloadbalancing:CreateListener",
        "elasticloadbalancing:CreateLoadBalancer",
        "elasticloadbalancing:CreateRule",
        "elasticloadbalancing:CreateTargetGroup",
        "elasticloadbalancing:DeleteListener",
        "elasticloadbalancing:DeleteLoadBalancer",
        "elasticloadbalancing:DeleteRule",
        "elasticloadbalancing:DeleteTargetGroup",
        "elasticloadbalancing:DescribeListeners",
        "elasticloadbalancing:DescribeLoadBalancers",
        "elasticloadbalancing:DescribeRules",
        "elasticloadbalancing:DescribeTargetGroups",
        "events:DeleteRule",
        "events:DescribeRule",
        "events:ListRuleNamesByTarget",
        "events:ListTargetsByRule",
        "events:PutRule",
        "events:PutTargets",
        "events:RemoveTargets",
        "fsx:DescribeFileSystems",
        "iam:ListAttachedRolePolicies",
        "iam:ListInstanceProfiles",
        "iam:ListRoles",
        "lambda:ListFunctions",
        "logs:CreateLogGroup",
        "logs:DescribeLogGroups",
        "logs:FilterLogEvents",
        "route53:CreateHostedZone",
        "route53:DeleteHostedZone",
        "route53:GetHealthCheck",
        "route53:GetHostedZone",
        "route53:ListHostedZonesByName",
        "servicediscovery:CreatePrivateDnsNamespace",
        "servicediscovery:CreateService",
        "servicediscovery:DeleteService",
        "servicediscovery:GetNamespace",
        "servicediscovery:GetOperation",
        "servicediscovery:GetService",
        "servicediscovery:ListNamespaces",
        "servicediscovery:ListServices",
        "servicediscovery:UpdateService",
        "sns:ListTopics"
      ],
      "Resource": [
        "*"
      ]
    },
    {
      "Sid": "SSMPolicy",
      "Effect": "Allow",
      "Action": [
        "ssm:GetParameter",
        "ssm:GetParameters",
        "ssm:GetParametersByPath"
      ],
      "Resource": "arn:aws:ssm:*:*:parameter/aws/service/ecs*"
    },
    {
      "Sid": "ManagedCloudformationResourcesCleanupPolicy",
      "Effect": "Allow",
      "Action": [
        "ec2:DeleteInternetGateway",
        "ec2:DeleteRoute",
        "ec2:DeleteRouteTable",
        "ec2:DeleteSecurityGroup"
      ],
      "Resource": [
        "*"
      ],
      "Condition": {
        "StringLike": {
          "ec2:ResourceTag/aws:cloudformation:stack-name": "EC2ContainerService-*"
        }
      }
    },
    {
      "Sid": "TasksPassRolePolicy",
      "Action": "iam:PassRole",
      "Effect": "Allow",
      "Resource": [
        "*"
      ],
      "Condition": {
        "StringLike": {
          "iam:PassedToService": "ecs-tasks.amazonaws.com"
        }
      }
    },
    {
      "Sid": "InfrastructurePassRolePolicy",
      "Action": "iam:PassRole",
      "Effect": "Allow",
      "Resource": [
        "arn:aws:iam::*:role/ecsInfrastructureRole"
      ],
      "Condition": {
        "StringEquals": {
          "iam:PassedToService": "ecs.amazonaws.com"
        }
      }
    },
    {
      "Sid": "InstancePassRolePolicy",
      "Action": "iam:PassRole",
      "Effect": "Allow",
      "Resource": [
        "arn:aws:iam::*:role/ecsInstanceRole*"
      ],
      "Condition": {
        "StringLike": {
          "iam:PassedToService": [
            "ec2.amazonaws.com",
            "ec2.amazonaws.com.cn"
          ]
        }
      }
    },
    {
      "Sid": "AutoScalingPassRolePolicy",
      "Action": "iam:PassRole",
      "Effect": "Allow",
      "Resource": [
        "arn:aws:iam::*:role/ecsAutoscaleRole*"
      ],
      "Condition": {
        "StringLike": {
          "iam:PassedToService": [
            "application-autoscaling.amazonaws.com",
            "application-autoscaling.amazonaws.com.cn"
          ]
        }
      }
    },
    {
      "Sid": "ServiceLinkedRoleCreationPolicy",
      "Effect": "Allow",
      "Action": "iam:CreateServiceLinkedRole",
      "Resource": "*",
      "Condition": {
        "StringLike": {
          "iam:AWSServiceName": [
            "ecs.amazonaws.com",
            "autoscaling.amazonaws.com",
            "ecs.application-autoscaling.amazonaws.com",
            "spot.amazonaws.com",
            "spotfleet.amazonaws.com"
          ]
        }
      }
    },
    {
      "Sid": "ELBTaggingPolicy",
      "Effect": "Allow",
      "Action": [
        "elasticloadbalancing:AddTags"
      ],
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "elasticloadbalancing:CreateAction": [
            "CreateTargetGroup",
            "CreateRule",
            "CreateListener",
            "CreateLoadBalancer"
          ]
        }
      }
    },
    {
      "Sid": "CloudFormationTagOnCreate",
      "Effect": "Allow",
      "Action": [
        "cloudformation:TagResource",
        "cloudformation:UntagResource"
      ],
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "cloudformation:CreateAction": [
            "CreateStack",
            "UpdateStack"
          ]
        }
      }
    }
  ]
}

Version history

Current version v22, edited by AWS on 2026-09-02. Version history is recorded from 2026-11-11. Earlier versions are in the IAM console under Policy versions.

Attach snippets

aws iam attach-role-policy --role-name ROLE_NAME --policy-arn arn:aws:iam::aws:policy/AmazonECS_FullAccess
aws iam attach-user-policy --user-name USER_NAME --policy-arn arn:aws:iam::aws:policy/AmazonECS_FullAccess
aws iam attach-group-policy --group-name GROUP_NAME --policy-arn arn:aws:iam::aws:policy/AmazonECS_FullAccess

Resources:
  ExampleRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument: {}  # replace with your trust policy
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AmazonECS_FullAccess

resource "aws_iam_role_policy_attachment" "amazonecs_fullaccess" {
  role       = aws_iam_role.example.name
  policy_arn = "arn:aws:iam::aws:policy/AmazonECS_FullAccess"
}

role.addManagedPolicy(
  iam.ManagedPolicy.fromAwsManagedPolicyName("AmazonECS_FullAccess"),
);

Sources

• AmazonECS_FullAccess (AWS Managed Policy Reference Guide) (retrieved 2026-11-13; supports summary, practicalScope, securityConsiderations, assignmentGuidance, faqs, useCases)
• AWS managed policies for Amazon ECS (retrieved 2026-11-13; supports summary, useCases, assignmentGuidance, faqs)
• Grant a user permissions to pass a role to an AWS service (IAM User Guide) (retrieved 2026-11-13; supports securityConsiderations, faqs)
• Managed policies and inline policies (IAM User Guide) (retrieved 2026-11-12; supports securityConsiderations, faqs)
• AWS managed policies for job functions (IAM User Guide) (retrieved 2026-11-12; supports bestPractices, faqs)

• Official AWS reference for AmazonECS_FullAccess
• AWS service guide
• Report a data issue