[ECS] [RunTask + StartTask IAM Condition Keys]: Expand support for IAM condition keys on RunTask and StartTask APIs
- Dominant language
- Shell
- Stars
- 5.4k
- Forks
- 334
- PR merge metrics
- No merged PRs in 30d
Description
### Community Note
* Please vote on this issue by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original issue to help the community and maintainers prioritize this request
* Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
* If you are interested in working on this issue or have submitted a pull request, please leave a comment
**Tell us about your request**
Please expand IAM condition key support for `ecs:task-cpu` and `ecs:task-memory` so they can be applied to the `RunTask` and `StartTask` APIs.
**Which service(s) is this request for?**
ECS
**Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard?**
ECS recently [announced the launch of new IAM condition keys](https://aws.amazon.com/about-aws/whats-new/2025/02/amazon-ecs-additional-iam-condition-keys/), which can be used to limit cpu and memory for ECS Tasks.
However, these new condition keys do not apply to the ECS RunTask or StartTask APIs, both of which can be used to to run tasks that don't adhere to any cpu and memory limits set on the [supported APIs (RegisterTaskDefinition, CreateService, UpdateService)](https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonelasticcontainerservice.html#amazonelasticcontainerservice-actions-as-permissions).
This is a problem because we need to create an IAM policy that prevents ECS Tasks from being created if they exceed certain cpu and memory limits.
**Are you currently working around this issue?**
We do not have a solution for this problem. The only work-around we're aware of is to deny access to the `RunTask` and `StartTask` actions, but that is not an option for us right now.
**Additional context**
Example command for calling RunTask with cpu and memory overrides
```
aws ecs run-task --task-definition --cluster --network-configuration '{ "awsvpcConfiguration": { "assignPublicIp": "ENABLED", "securityGroups": [""], "subnets": [""] } }' --launch-type FARGATE --overrides '{ "cpu": "16384", "memory": "122880" }'
```
Contributor guide
Research direction
The issue names no repository files, tests, or implementation entry points. Start by reviewing the AWS ECS IAM condition-key documentation and the RunTask and StartTask API behavior described in the issue, including the CPU and memory override example. Done means ecs:task-cpu and ecs:task-memory can constrain both APIs.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws
- Domain
- authorization, cloud
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100