aws / aws/containers-roadmap

[ECS] [RunTask + StartTask IAM Condition Keys]: Expand support for IAM condition keys on RunTask and StartTask APIs

Open
#2,559 1 comment 3 reactions 0 assignees View on GitHub
ECS Proposed
Dominant language
Shell
Stars
5.4k
Forks
334
PR merge metrics
No merged PRs in 30d

Description

### Community Note

* Please vote on this issue by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original issue to help the community and maintainers prioritize this request
* Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
* If you are interested in working on this issue or have submitted a pull request, please leave a comment

**Tell us about your request**
Please expand IAM condition key support for `ecs:task-cpu` and `ecs:task-memory` so they can be applied to the `RunTask` and `StartTask` APIs.

**Which service(s) is this request for?**
ECS

**Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard?**
ECS recently [announced the launch of new IAM condition keys](https://aws.amazon.com/about-aws/whats-new/2025/02/amazon-ecs-additional-iam-condition-keys/), which can be used to limit cpu and memory for ECS Tasks.

However, these new condition keys do not apply to the ECS RunTask or StartTask APIs, both of which can be used to to run tasks that don't adhere to any cpu and memory limits set on the [supported APIs (RegisterTaskDefinition, CreateService, UpdateService)](https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonelasticcontainerservice.html#amazonelasticcontainerservice-actions-as-permissions).

This is a problem because we need to create an IAM policy that prevents ECS Tasks from being created if they exceed certain cpu and memory limits.

**Are you currently working around this issue?**
We do not have a solution for this problem. The only work-around we're aware of is to deny access to the `RunTask` and `StartTask` actions, but that is not an option for us right now.

**Additional context**
Example command for calling RunTask with cpu and memory overrides
```
aws ecs run-task --task-definition --cluster --network-configuration '{ "awsvpcConfiguration": { "assignPublicIp": "ENABLED", "securityGroups": [""], "subnets": [""] } }' --launch-type FARGATE --overrides '{ "cpu": "16384", "memory": "122880" }'
```

Contributor guide

Open the contributing guide

Research direction

The issue names no repository files, tests, or implementation entry points. Start by reviewing the AWS ECS IAM condition-key documentation and the RunTask and StartTask API behavior described in the issue, including the CPU and memory override example. Done means ecs:task-cpu and ecs:task-memory can constrain both APIs.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws
Domain
authorization, cloud
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.