Is it possible to assume a role from a running task in ECS?

Question

I'm looking for an example of how to assume a role from within a running application within ECS.

I have a role setup, and I've added the roleARN to the task definition, using the setup here: https://docs.aws.amazon.com/en_us/AmazonECS/latest/developerguide/task-iam-roles.html

Can I then assume the role from the application logic as usual? Or is there something special required?

I have this setup working, but with a IAM User which has a Secret Key and Access Key used as credentials within my application. Would switching this auth to the assume role be possible with the setup above?

Answer 1

The AWS SDK and CLI will automatically handle using the credentials from the assigned IAM task role.

Note that when you specify an IAM role for a task, the AWS CLI or other SDKs in the containers for that task use the AWS credentials provided by the task role exclusively and they no longer inherit any IAM permissions from the container instance.