amazon-web-services - ECS 任务的任务执行角色 - Cloudformation

Question

我正在尝试访问使用 aws 控制台创建的 IAM 角色。该角色很简单，因为我必须提供 ecs taskexcutionrole，以便它有权从 ECR 中提取镜像。我已经想出了这段代码，我在这段代码中缺少什么？

    Role:
        Type: 'AWS::IAM::Role'
        Properties:
          AssumeRolePolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Principal:
                  Service:
                    - ec2.amazonaws.com
                Action:
                  - 'sts:AssumeRole'
          Path: /
          ManagedPolicyArns:
            - arn:aws:iam::02004621356:role/ecs-ec2-task

2- 如果我想创建一个新的任务执行角色并只授予从 ECR 提取镜像的权限，我应该进行哪些更改？

Answer 1

信任原则should是 ecs-tasks.amazonaws.com:

Role:
    Type: 'AWS::IAM::Role'
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - ecs-tasks.amazonaws.com
            Action:
              - 'sts:AssumeRole'
      Path: /
      ManagedPolicyArns:
        - arn:aws:iam::02004621356:role/ecs-ec2-task
      Policies: 
        - PolicyName: AccessECR
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action: 
                  - ecr:BatchGetImage
                  - ecr:GetAuthorizationToken
                  - ecr:GetDownloadUrlForLayer 
                Resource: '*'