Operations Actions Permission-only actions Resource types Condition keys

Actions, resources, and condition keys for Amazon Elastic Container Service

Amazon Elastic Container Service (service prefix: ecs) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Topics

API operations defined by Amazon Elastic Container Service
Actions defined by Amazon Elastic Container Service
Permission-only actions for Amazon Elastic Container Service
Resource types defined by Amazon Elastic Container Service
Condition keys for Amazon Elastic Container Service

API operations defined by Amazon Elastic Container Service

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Condition key	Possible value(s)	Access level
ContinueServiceDeployment	ecs:ContinueServiceDeployment			Write
CreateCapacityProvider	ecs:CreateCapacityProvider			Write
	ecs:PutClusterCapacityProviders			Write
	ecs:TagResource			Tagging, Write
	iam:PassRole	iam:PassedToService	ecs.amazonaws.com	Write
CreateCluster	ecs:CreateCluster			Write
CreateCluster	ecs:TagResource			Tagging, Write
CreateDaemon	ecs:CreateDaemon			Write
	ecs:TagResource			Tagging, Write
	iam:PassRole	iam:PassedToService	ecs-tasks.amazonaws.com	Write
CreateExpressGatewayService	ecs:CreateCluster			Write
	ecs:CreateExpressGatewayService			Write
	ecs:RegisterTaskDefinition			Write
	ecs:TagResource			Tagging, Write
	iam:PassRole	iam:PassedToService	ecs-tasks.amazonaws.com, ecs.amazonaws.com	Write
CreateService	ecs:CreateService			Write
	ecs:TagResource			Tagging, Write
	iam:PassRole	iam:PassedToService	ecs-tasks.amazonaws.com, ecs.amazonaws.com	Write
CreateTaskSet	ecs:CreateTaskSet			Write
	ecs:TagResource			Tagging, Write
	iam:PassRole	iam:PassedToService	ecs-tasks.amazonaws.com	Write
DeleteAccountSetting	ecs:DeleteAccountSetting			Write
DeleteAttributes	ecs:DeleteAttributes			Write
DeleteCapacityProvider	ecs:DeleteCapacityProvider			Write
DeleteCapacityProvider	ecs:PutClusterCapacityProviders			Write
DeleteCluster	ecs:DeleteCluster			Write
DeleteDaemon	ecs:DeleteDaemon			Write
DeleteDaemonTaskDefinition	ecs:DeleteDaemonTaskDefinition			Write
DeleteExpressGatewayService	ecs:DeleteExpressGatewayService			Write
DeleteService	ecs:DeleteService			Write
DeleteTaskDefinitions	ecs:DeleteTaskDefinitions			Write
DeleteTaskSet	ecs:DeleteTaskSet			Write
DeregisterContainerInstance	ecs:DeregisterContainerInstance			Write
DeregisterTaskDefinition	ecs:DeregisterTaskDefinition			Write
DescribeCapacityProviders	ecs:DescribeCapacityProviders			Read
DescribeClusters	ecs:DescribeClusters			Read
DescribeContainerInstances	ecs:DescribeContainerInstances			Read
DescribeDaemon	ecs:DescribeDaemon			Read
DescribeDaemonDeployments	ecs:DescribeDaemonDeployments			Read
DescribeDaemonRevisions	ecs:DescribeDaemonRevisions			Read
DescribeDaemonTaskDefinition	ecs:DescribeDaemonTaskDefinition			Read
DescribeExpressGatewayService	ecs:DescribeExpressGatewayService			Read
DescribeServiceDeployments	ecs:DescribeServiceDeployments			Read
DescribeServiceRevisions	ecs:DescribeServiceRevisions			Read
DescribeServices	ecs:DescribeServices			Read
DescribeTaskDefinition	ecs:DescribeTaskDefinition			Read
DescribeTaskSets	ecs:DescribeTaskSets			Read
DescribeTasks	ecs:DescribeTasks			Read
DiscoverPollEndpoint	ecs:DiscoverPollEndpoint			Write
ExecuteCommand	ecs:ExecuteCommand			Write
GetTaskProtection	ecs:GetTaskProtection			Read
ListAccountSettings	ecs:ListAccountSettings			Read
ListAttributes	ecs:ListAttributes