@Marvin what aws IAM permissions are required for AWS service accounts to start ECS tasks

Ah, the joys of AWS IAM permissions. Here's what you need to know: Your Amazon ECS tasks can have an IAM role associated with them. The permissions granted in the IAM role are assumed by the containers running in the task. If your containerized applications need to call AWS APIs, they must sign their AWS API requests with AWS credentials, and a task IAM role provides a strategy for managing credentials for your applications to use. Benefits of using IAM roles with your tasks include: 1. Credential Isolation: A container can only retrieve credentials for the IAM role that is defined in the task definition to which it belongs; a container never has access to credentials that are intended for another container that belongs to another task. 2. Authorization: Unauthorized containers cannot access IAM role credentials defined for other tasks. 3. Auditability: Access and event logging is available through CloudTrail to ensure retrospective auditing. The task execution role grants the Amazon ECS container and Fargate agents permission to make AWS API calls on your behalf. The task execution IAM role is required depending on the requirements of your task. You can have multiple task execution roles for different purposes and services associated with your account. Common use cases for a task execution IAM role include: - Your task is hosted on AWS Fargate or on an external instance and is pulling a container image from an Amazon ECR private repository. - Your tasks are hosted on either AWS Fargate or Amazon EC2 instances and is using private registry authentication. When assigning IAM roles for a task, you must use the following trust policy so that each of your tasks can assume an IAM role that's different from the one that your EC2 instance uses:

json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "",
      "Effect": "Allow",
      "Principal": {
        "Service": "<http://ecs-tasks.amazonaws.com|ecs-tasks.amazonaws.com>"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

For more detailed information, you may want to visit the AWS Documentation. Remember, with great power comes great responsibility. Or in this case, with great IAM permissions comes great potential for security headaches.