Docs

Elastic Compute Service

IAM

Authorizing ECS instances to access cloud resources based on instance IAM roles

When ECS instances need to access other cloud resources, they must first undergo verification of identity information and access permissions based on access credentials. You can associate an IAM role with the ECS instance. This allows the instance and its applications to access other cloud resources via temporary security credentials provided by the Security Token Service (STS). Compared to resource access directly with an AccessKey, this method does not need to expose long-term AccessKeys. This ensures the security of keys under your account. Additionally, this method enables more fine-grained permission control through IAM features, which prevents excessive permission assignment.

This topic mainly describes how to create an IAM role and associate it with an ECS instance, as well as how to obtain temporary access credentials based on the instance IAM role. What is an IAM role?

Advantages

Using temporary access credentials obtained from an instance IAM role to verify identity and access permissions offers the following advantages:

Temporary STS access credentials are used to access other cloud resources instead of long-term AccessKeys. This reduces the risk of access key leakage.

Temporary STS access credentials support custom validity periods and expire automatically after the period ends.

Different roles with different permission policies can be assigned to different instances. This allows instances to have different access permissions to different cloud resources and constrains the permission scope with finer granularity.

You do not need to store SecretKey in instances manually. To change permissions, you only need to change policies of IAM roles, which helps with quick maintenance of instance access permissions.

Limits

Only IAM service roles with the trust identity of ecs can be associated with ECS instances.

You can associate an ECS instance with one IAM role in total, either a service-associated role or a general service role.

Currently, you cannot associate IAM roles with multiple instances at the same time.

Usage notes

If your account is an IAM user, contact the root user first to obtain IAM management permissions. For more information, refer to Creating users and authorizing them. The permission policy to be granted is shown in IAMFullAccess.

Procedure

Step 1: Create a role for ECS service and grant one or more permissions to the role

tip

This topic uses creating a general service role as an example, where you do not select the "Create as a service-associated role (ServiceLinkedRole)" option.

Service-associated role: You only need to select a trusted cloud service. The role information and permission policy are preset by the system and can not be customized.

General service role: You need to select a trusted cloud service and customize role information and permission policies.

Click the "Create New Role" button.

For trust identity, select "Services", and then select the "ecs" service.

Click the "Next" button to configure the role name, display name, and other information.

Click the "Next" button to start adding permissions.

Authorize one or more system default policies or existing custom policies to the IAM role and specify the scope. This grants the role permissions to access or operate related resources. For example, add the TOSReadOnlyAccess policy to the current role to grant it read-only access permission to TOS.

tip

If existing policies can not meet your needs for refined management, skip this step and directly create a role. After the role is created, you can create a new custom policy, then add it to this role.

Click the "Submit" button to complete the operation. Then, you can view the newly created role from the role list on the Role Management page.

Step 2: Associate the role with an ECS instance

warning

After being associated with an IAM role, the instance is granted all permissions that the role has. Therefore, please proceed with caution.

In the left-side navigation pane, select "Instances & Images > Instances".

In the top menu bar, select the project and region of the target instance.

Click "... > Instance settings > Bind IAM roles" in the "Actions" column of the target instance.

Select the needed role from the dropdown list or enter it manually, then click the "Confirm" button.

tip

This page only displays IAM roles with the trust identity service set as ecs. Other roles can not be associated.

If no role is available, you can click the "Create New Role" button to create one. For details, follow the guidance in Step 1.

Step 3: Obtain temporary access credentials based on instance IAM roles

By using an instance IAM role to call the AssumeRole interface of STS, you can obtain temporary security credentials of the account that the role belongs to, and access cloud resources as the identity of that account. For details, refer to AssumeRole (obtaining temporary security token via role assumption).

When calling the interface, you need to enter the role TRN. As shown in the figure below, you can obtain the TRN of the IAM role on the Role detail page.

Subsequent operations

Disassociate an IAM role from an instance

Change the IAM role of an instance

In the left-side navigation pane, select "Instances & Images > Instances".

In the top menu bar, select the project and region of the target instance.

Click "... > Instance settings > Unbind IAM roles" in the "Actions" column of the target instance.

Click the "Confirm" button to disassociate.