Ravi Sir's Cards › AWS
ECS: two roles
What is a VPC: your own private network inside one AWS Region, example ThreeTierVpc 10.0.0.0/16.
Read card text
What this card says
Why do we need it?
ECS needs to pull the image and your app needs DynamoDB. One role for both gives too much power.
What is it?
Execution role = ECS agent (ECR pull, logs). Task role = your code (DynamoDB, S3).
executionRoleArn / taskRoleArn
How to do it
Trust ecs-tasks.amazonaws.com in both. Set both ARNs in the task definition.
Example
CannotPullContainerError = execution role. AccessDenied from app = task role.