When setting up a flow to run on ECS, is it the

task_role_arn

or the

execution_role_arn

that needs read access to the S3 bucket where the flow is deployed?

at a guess it would be the task execution role

Which of the two options would that be?

execution_role_arn