IAM error when using ecs-cli

Question

I try to create a new task for ECS using the compose file, but I get an AccessDeniedException even when my user has the necessary permissions.

$ ecs-cli compose --project-name test create
WARN[0000] Skipping unsupported YAML option for service...  option name=build service name=builder
WARN[0000] Skipping unsupported YAML option for service...  option name=restart service name=db
WARN[0000] Skipping unsupported YAML option for service...  option name=restart service name=dbadmin
WARN[0000] Skipping unsupported YAML option for service...  option name=restart service name=app
ERRO[0001] Error registering task definition             error=AccessDeniedException: User: arn:aws:iam::XXXXXXX:user/foo is not authorized to perform: ecs:RegisterTaskDefinition on resource: *
    status code: 400, request id: 41e6b69a-a839-11e6-84b0-e9bc2ec3f81b family=ecscompose-test
ERRO[0001] Create task definition failed                 error=AccessDeniedException: User: arn:aws:iam::XXXXXXX:user/foo is not authorized to perform: ecs:RegisterTaskDefinition on resource: *
    status code: 400, request id: 41e6b69a-a839-11e6-84b0-e9bc2ec3f81b
FATA[0001] AccessDeniedException: User: arn:aws:iam::XXXXXXX:user/foo is not authorized to perform: ecs:RegisterTaskDefinition on resource: *
    status code: 400, request id: 41e6b69a-a839-11e6-84b0-e9bc2ec3f81b 

The user has this policy:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ecs:RegisterTaskDefinition",
                "ecs:ListTaskDefinitions",
                "ecs:DescribeTaskDefinition"
            ],
            "Resource": [
                "*"
            ]
        }
    ]
}

I also tried connecting AmazonEC2ContainerServiceFullAccess (with ecs: *), but it didn't work.

Answer 1

The problem was found, the user I was using with had an MFA (MultiFactor Auth) usage policy, which is not supported by ecs-cli.

Answer 2

, , , .

AWS ecs-cli

" , , ecs-cli Docker Compose"

"WARN [0000] YAML ..."

Answer 3

ECS . , , .

When you see 400 AccessDeniedExceptions that are in the form "user_arn is not authorized to execute the service: action on service_resource", this is definitely an IAM problem. However, the IAM policy you quoted looks correct. I think that you are somehow not using the correct user credentials or that the IAM policy is not correctly applied to the user.