docker
/
docs
mirror of https://github.com/docker/docs.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #12251 from ollypom/ecs-iam-permissions 

Added Additional IAM Permissions for ECS
This commit is contained in:
Usha Mandya 2021-02-04 16:42:10 +00:00 committed by GitHub
parent c43f1282da e35fc9b196
commit d1a0204d96
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 32 additions and 18 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

40
cloud/ecs-integration.md
View File

@ -45,31 +45,45 @@ AWS uses a fine-grained permission model, with specific role for each resource t
To ensure that Docker ECS integration is allowed to manage resources for your Compose application, you have to ensure your AWS credentials [grant access to following AWS IAM permissions](https://aws.amazon.com/iam/features/manage-permissions/): To ensure that Docker ECS integration is allowed to manage resources for your Compose application, you have to ensure your AWS credentials [grant access to following AWS IAM permissions](https://aws.amazon.com/iam/features/manage-permissions/):
* application-autoscaling:*
* cloudformation:* * cloudformation:*
* ecs:ListAccountSettings * ec2:AuthorizeSecurityGroupIngress
* ec2:CreateSecurityGroup
* ec2:CreateTags
* ec2:DeleteSecurityGroup
* ec2:DescribeRouteTables
* ec2:DescribeSecurityGroups
* ec2:DescribeSubnets
* ec2:DescribeVpcs
* ec2:RevokeSecurityGroupIngress
* ecs:CreateCluster * ecs:CreateCluster
* ecs:CreateService * ecs:CreateService
* ec2:DescribeVpcs * ecs:DeleteCluster
* ec2:DescribeSubnets * ecs:DeleteService
* ec2:CreateSecurityGroup * ecs:DeregisterTaskDefinition
* ec2:DescribeSecurityGroups * ecs:DescribeClusters
* ec2:DeleteSecurityGroup * ecs:DescribeServices
* iam:CreateRole * ecs:DescribeTasks
* iam:AttachRolePolicy * ecs:ListAccountSettings
* iam:DetachRolePolicy * ecs:ListTasks
* iam:DeleteRole * ecs:RegisterTaskDefinition
* ecs:UpdateService
* elasticloadbalancing:* * elasticloadbalancing:*
* application-autoscaling:* * iam:AttachRolePolicy
* servicediscovery:* * iam:CreateRole
* iam:DeleteRole
* iam:DetachRolePolicy
* iam:PassRole
* logs:CreateLogGroup * logs:CreateLogGroup
* logs:DeleteLogGroup
* logs:DescribeLogGroups * logs:DescribeLogGroups
* logs:FilterLogEvents * logs:FilterLogEvents
* logs:DeleteLogGroup
* route53:CreateHostedZone * route53:CreateHostedZone
* route53:DeleteHostedZone * route53:DeleteHostedZone
* route53:GetHealthCheck * route53:GetHealthCheck
* route53:GetHostedZone * route53:GetHostedZone
* route53:ListHostedZonesByName * route53:ListHostedZonesByName
* servicediscovery:*
GPU support, which relies on EC2 instances to run containers with attached GPU devices, GPU support, which relies on EC2 instances to run containers with attached GPU devices,
require a few additional permissions: require a few additional permissions: