Elastic Container Service
Prefix ecs, 92 actions · Domain Containers
23 AWS managed policies. 2 have reviewed guidance; the rest have authoritative permission data pending editorial review. 8 are service-linked role policies, shown with permission data only.
User access (3)
Operator and limited (5)
Service roles (7)
Service-linked roles (8)
- AmazonFISServiceRolePolicyOperator
- AmazonGuardDutyMalwareProtectionServiceRolePolicyOperator
- AWSApplicationAutoscalingECSServicePolicyOperator
- AWSMediaConnectServicePolicyOperator
- AWSMediaLiveAnywhereServiceRolePolicyOperator
- AWSNetworkFirewallIGWServiceRolePolicyOperator
- AWSNetworkFirewallServiceRolePolicyOperator
- BatchServiceRolePolicyOperator
Also grants Elastic Container Service actions (39)
- AdministratorAccess
- AdministratorAccess-AWSElasticBeanstalk
- AIDevOpsAgentAccessPolicy
- AIDevOpsAgentActionsPolicy
- AIOpsAssistantPolicy
- AmazonGuardDutyServiceRolePolicy
- AmazonInspector2ServiceRolePolicy
- AssuranceServiceRolePolicy
- AWS_ConfigRole
- AWSAuditManagerServiceRolePolicy
- AWSCODAPermissionsBoundary
- AWSCodePipeline_FullAccess
- AWSConfigServiceRolePolicy
- AWSElasticBeanstalkManagedUpdatesCustomerRolePolicy
- AWSElasticBeanstalkManagedUpdatesServiceRolePolicy
- AWSElasticBeanstalkRoleCore
- AWSElasticBeanstalkService
- AWSFinOpsAgentServiceRolePolicy
- AWSMcpServiceActionsFullAccess
- AWSMigrationHubOrchestratorConsoleFullAccess
- AWSPartnerLedSupportReadOnlyAccess
- AWSResilienceHubAsssessmentExecutionPolicy
- AWSResilienceHubV2AssessmentExecutionPolicy
- AWSResourceExplorerServiceRolePolicy
- AWSSupportServiceRolePolicy
- AWSTrustedAdvisorServiceRolePolicy
- AWSWellArchitectedAgentResourceScanningServiceRolePolicy
- CloudWatchApplicationInsightsFullAccess
- CloudwatchApplicationInsightsServiceLinkedRolePolicy
- CloudWatchOmniAWSIntegrationPolicy
- ComputeOptimizerReadOnlyAccess
- FinOpsAgentAgentPolicy
- PowerUserAccess
- ReadOnlyAccess
- ResourceGroupsTaggingAPITagUntagSupportedResources
- SecurityAudit
- SupportUser
- ViewOnlyAccess
- WellArchitectedAgentResourceScanning
allowvendedlogdeliveryforresource associategatewaywithcluster continueservicedeployment createcapacityprovider createcluster createdaemon createexpressgatewayservice creategateway createservice createtaskset deleteaccountsetting deleteattributes deletecapacityprovider deletecluster deletedaemon deletedaemontaskdefinition deleteexpressgatewayservice deletegateway deleteservice deletetaskdefinitions deletetaskset deregistercontainerinstance deregistertaskdefinition describecapacityproviders describeclusters describecontainerinstances describedaemon describedaemondeployments describedaemonrevisions describedaemontaskdefinition describeexpressgatewayservice describegateway describegatewayresources describegatewayroute describeservicedeployments describeservicerevisions describeservices describetaskdefinition describetasksets describetasks disassociategatewayfromcluster discoverpollendpoint executecommand gettaskprotection listaccountsettings listattributes listclusters listcontainerinstances listdaemondeployments listdaemontaskdefinitions listdaemons listgatewayclusterassociations listgatewayroutes listgateways listservicedeployments listservices listservicesbynamespace listtagsforresource listtaskdefinitionfamilies listtaskdefinitions listtasks poll putaccountsetting putaccountsettingdefault putattributes putclustercapacityproviders putsystemlogevents registercontainerinstance registerdaemontaskdefinition registertaskdefinition runtask starttask starttelemetrysession stopservicedeployment stoptask submitattachmentstatechanges submitcontainerstatechange submittaskstatechange tagresource untagresource updatecapacityprovider updatecluster updateclustersettings updatecontaineragent updatecontainerinstancesstate updatedaemon updateexpressgatewayservice updategateway updateservice updateserviceprimarytaskset updatetaskprotection updatetaskset
Actions (92)
| Action | Access level | Policies granting without limits | Policies granting with resource or condition limits |
|---|---|---|---|
| ecs:AllowVendedLogDeliveryForResource | Permissions management | 5 | 1 |
| ecs:AssociateGatewayWithCluster | Write | 5 | 1 |
| ecs:ContinueServiceDeployment | Write | 5 | 1 |
| ecs:CreateCapacityProvider | Write | 5 | 2 |
| ecs:CreateCluster | Write | 12 | 4 |
| ecs:CreateDaemon | Write | 5 | 1 |
| ecs:CreateExpressGatewayService | Write | 5 | 1 |
| ecs:CreateGateway | Write | 5 | 1 |
| ecs:CreateService | Write | 5 | 4 |
| ecs:CreateTaskSet | Write | 7 | 1 |
| ecs:DeleteAccountSetting | Write | 5 | 1 |
| ecs:DeleteAttributes | Write | 5 | 2 |
| ecs:DeleteCapacityProvider | Write | 5 | 2 |
| ecs:DeleteCluster | Write | 8 | 5 |
| ecs:DeleteDaemon | Write | 5 | 1 |
| ecs:DeleteDaemonTaskDefinition | Write | 5 | 1 |
| ecs:DeleteExpressGatewayService | Write | 5 | 1 |
| ecs:DeleteGateway | Write | 5 | 1 |
| ecs:DeleteService | Write | 5 | 4 |
| ecs:DeleteTaskDefinitions | Write | 5 | 2 |
| ecs:DeleteTaskSet | Write | 7 | 1 |
| ecs:DeregisterContainerInstance | Write | 8 | 4 |
| ecs:DeregisterTaskDefinition | Write | 11 | 1 |
| ecs:DescribeCapacityProviders | Read | 25 | 3 |
| ecs:DescribeClusters | Read | 35 | 5 |
| ecs:DescribeContainerInstances | Read | 27 | 6 |
| ecs:DescribeDaemon | Read | 20 | 3 |
| ecs:DescribeDaemonDeployments | Read | 19 | 1 |
| ecs:DescribeDaemonRevisions | Read | 18 | 1 |
| ecs:DescribeDaemonTaskDefinition | Read | 20 | 2 |
| ecs:DescribeExpressGatewayService | Read | 22 | 1 |
| ecs:DescribeGateway | Read | 18 | 1 |
| ecs:DescribeGatewayResources | Read | 18 | 1 |
| ecs:DescribeGatewayRoute | Read | 18 | 1 |
| ecs:DescribeServiceDeployments | Read | 20 | 1 |
| ecs:DescribeServiceRevisions | Read | 21 | 1 |
| ecs:DescribeServices | Read | 31 | 4 |
| ecs:DescribeTaskDefinition | Read | 30 | 4 |
| ecs:DescribeTaskSets | Read | 24 | 2 |
| ecs:DescribeTasks | Read | 30 | 8 |
| ecs:DisassociateGatewayFromCluster | Write | 5 | 1 |
| ecs:DiscoverPollEndpoint | Write | 8 | 1 |
| ecs:ExecuteCommand | Write | 5 | 2 |
| ecs:GetTaskProtection | Read | 8 | 1 |
| ecs:ListAccountSettings | Read | 22 | 1 |
| ecs:ListAttributes | List | 20 | 2 |
| ecs:ListClusters | List | 36 | 4 |
| ecs:ListContainerInstances | List | 27 | 7 |
| ecs:ListDaemonDeployments | List | 18 | 1 |
| ecs:ListDaemonTaskDefinitions | List | 20 | 2 |
| ecs:ListDaemons | List | 20 | 3 |
| ecs:ListGatewayClusterAssociations | List | 18 | 1 |
| ecs:ListGatewayRoutes | List | 18 | 1 |
| ecs:ListGateways | List | 18 | 1 |
| ecs:ListServiceDeployments | List | 20 | 1 |
| ecs:ListServices | List | 31 | 3 |
| ecs:ListServicesByNamespace | List | 20 | 1 |
| ecs:ListTagsForResource | Read | 24 | 4 |
| ecs:ListTaskDefinitionFamilies | List | 26 | 2 |
| ecs:ListTaskDefinitions | List | 27 | 3 |
| ecs:ListTasks | List | 30 | 7 |
| ecs:Poll | Write | 7 | 2 |
| ecs:PutAccountSetting | Write | 5 | 1 |
| ecs:PutAccountSettingDefault | Write | 5 | 2 |
| ecs:PutAttributes | Write | 5 | 2 |
| ecs:PutClusterCapacityProviders | Write | 5 | 2 |
| ecs:PutSystemLogEvents | Write | 5 | 2 |
| ecs:RegisterContainerInstance | Write | 7 | 2 |
| ecs:RegisterDaemonTaskDefinition | Write | 5 | 1 |
| ecs:RegisterTaskDefinition | Write | 12 | 5 |
| ecs:RunTask | Write | 7 | 4 |
| ecs:StartTask | Write | 7 | 3 |
| ecs:StartTelemetrySession | Write | 7 | 2 |
| ecs:StopServiceDeployment | Write | 5 | 1 |
| ecs:StopTask | Write | 7 | 4 |
| ecs:SubmitAttachmentStateChanges | Write | 7 | 2 |
| ecs:SubmitContainerStateChange | Write | 7 | 1 |
| ecs:SubmitTaskStateChange | Write | 7 | 2 |
| ecs:TagResource | Tagging | 7 | 13 |
| ecs:UntagResource | Tagging | 6 | 4 |
| ecs:UpdateCapacityProvider | Write | 5 | 2 |
| ecs:UpdateCluster | Write | 6 | 4 |
| ecs:UpdateClusterSettings | Write | 5 | 3 |
| ecs:UpdateContainerAgent | Write | 6 | 1 |
| ecs:UpdateContainerInstancesState | Write | 6 | 3 |
| ecs:UpdateDaemon | Write | 5 | 1 |
| ecs:UpdateExpressGatewayService | Write | 5 | 1 |
| ecs:UpdateGateway | Write | 5 | 1 |
| ecs:UpdateService | Write | 7 | 5 |
| ecs:UpdateServicePrimaryTaskSet | Write | 7 | 1 |
| ecs:UpdateTaskProtection | Write | 5 | 1 |
| ecs:UpdateTaskSet | Write | 5 | 1 |