How do I set up IAM for ECS Exec with Nginx on ECS?

In this guide, we will set up IAM for ECS Exec with Nginx on ECS using Pulumi. We will create an ECS cluster, define a task definition for Nginx, set up an IAM role for ECS Exec, and create an ECS service to run the Nginx container.

Key Points

Create an ECS cluster.
Define a task definition for running Nginx.
Set up an IAM role with the necessary permissions for ECS Exec.
Create an ECS service to run the Nginx container.

import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";

// Create an IAM role for ECS Exec
const ecsExecRole = new aws.iam.Role("ecsExecRole", {
    assumeRolePolicy: aws.iam.assumeRolePolicyForPrincipal({ Service: "ecs-tasks.amazonaws.com" }),
});

// Attach the AmazonECSTaskExecutionRolePolicy to the ECS Exec role
new aws.iam.RolePolicyAttachment("ecsExecRolePolicyAttachment", {
    role: ecsExecRole.name,
    policyArn: "arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy",
});

// Create an ECS cluster
const cluster = new aws.ecs.Cluster("nginx-cluster");

// Define the Nginx task definition
const taskDefinition = new aws.ecs.TaskDefinition("nginx-task", {
    family: "nginx",
    cpu: "256",
    memory: "512",
    networkMode: "awsvpc",
    requiresCompatibilities: ["FARGATE"],
    executionRoleArn: ecsExecRole.arn,
    containerDefinitions: JSON.stringify([{
        name: "nginx",
        image: "nginx:latest",
        essential: true,
        portMappings: [{
            containerPort: 80,
            hostPort: 80,
            protocol: "tcp",
        }],
    }]),
});

// Create a security group for the ECS service
const securityGroup = new aws.ec2.SecurityGroup("nginx-sg", {
    description: "Allow HTTP traffic",
    ingress: [{
        protocol: "tcp",
        fromPort: 80,
        toPort: 80,
        cidrBlocks: ["0.0.0.0/0"],
    }],
    egress: [{
        protocol: "-1",
        fromPort: 0,
        toPort: 0,
        cidrBlocks: ["0.0.0.0/0"],
    }],
});

// Create an ECS service to run the Nginx task
const service = new aws.ecs.Service("nginx-service", {
    cluster: cluster.arn,
    taskDefinition: taskDefinition.arn,
    desiredCount: 1,
    launchType: "FARGATE",
    networkConfiguration: {
        subnets: ["subnet-xxxxxxxx"], // Replace with your subnet ID
        securityGroups: [securityGroup.id],
    },
    enableExecuteCommand: true, // Enable ECS Exec
});

Summary

In this guide, we created an ECS cluster and defined a task definition for running Nginx. We set up an IAM role with the necessary permissions for ECS Exec and created an ECS service to run the Nginx container with ECS Exec enabled. This setup allows you to use ECS Exec to run commands inside your Nginx container running on ECS.

Deploy this code

Want to deploy this code? Sign up for a free Pulumi account to deploy in a few clicks.

New to Pulumi?

Want to deploy this code? Sign up with Pulumi to deploy in a few clicks.