ecs:CreateService is a Write access-level action in the ecs service. Grants permission to run and maintain a desired number of tasks from a specified task definition via service creation
ARNs that ecs:CreateService can be scoped to in an IAM policy.
Keys you can use in the Condition block of a policy that grants ecs:CreateService.
Filters access by the tags that are passed in the request
Filters access by the tag keys that are passed in the request
Filters access by the public IP assignment configuration of your Amazon ECS task or Amazon ECS service that uses awsvpc network mode
Filters access by the ARN of an Amazon ECS capacity provider
Filters access by the Amazon ECS managed Amazon EBS volume capability of your ECS task or service
Filters access by the enableECSManagedTags configuration of your Amazon ECS task or Amazon ECS service
Filters access by the execute-command capability of your Amazon ECS task or Amazon ECS service
Filters access by the enable field value in the Service Connect configuration
Filters access by the VPC lattice capability of your Amazon ECS service
Filters access by the ARN of AWS Cloud Map namespace which is defined in the Service Connect Configuration
Filters access by the tag propagation configuration of your Amazon ECS task or Amazon ECS service
Filters access by the subnet configuration of your Amazon ECS task or Amazon ECS service that uses awsvpc network mode
Filters access by the task cpu, as an integer with 1024 = 1 vCPU, provided in the request
Filters access by the ARN of an Amazon ECS task definition
Filters access by the task memory, as an integer representing MiB, provided in the request
Filters access by the tag key-value pairs attached to the resource
Filters access by the ARN of an Amazon ECS cluster
A minimal policy that allows ecs:CreateService. Replace "Resource": "*" with a specific ARN to follow least privilege.
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowEcsCreateService",
"Effect": "Allow",
"Action": "ecs:CreateService",
"Resource": "*"
}
]
}