AWS ECS - How to pass task's execution role to Boto3?

Question

I am running an ECS service with EC2 instances running Windows Server 2019 AMI/Docker - but when running the task which uses boto3, the logs show

botocore.exceptions.NoCredentialsError: Unable to locate credentials

To my knowledge, the task's execution role is supposed to be provided to the container and boto3 is supposed to assume that role.

Is there additional configuration needed to get boto3 to assume the ECS instance role in a Windows container, or for ECS in general?

Answer 1

This can be a confusing subject. ECS tasks have two roles:

• The "Task Execution Role" which ECS uses for things like access to the ECR repository, and update load balancer targets, etc.
• The "Task Role" which the code running inside the ECS task can use to access AWS services.

For boto3 running inside ECS, you will have to specify a Task Role. After adding a task role, boto3 will pick up the credentials automatically.