Which role would you change when a container cannot read a secret?

Say it in 30 seconds

Say it like this (20-30 seconds)

I first ask when the secret is read. ECS uses the execution role to inject configured secrets while starting the container. Application AWS calls use the task role after startup. MiniTickets injects database credentials through the API execution role, while the API task role publishes booking events. I would change the role used by the failing operation, scoped to its exact action and resource, then verify the failure separately.

The deeper answer

A stopped task naming Secrets Manager during initialization points to the task definition’s secret reference, execution-role permission and network access. An application log naming an AWS SDK denial points to the credentials used by that process. The error’s caller ARN is stronger evidence than the name of a policy file.

The execution role also supports image pulls and container logging; it does not stop mattering after startup. The task role supports API runtime actions including SNS publishing, ticket reads, scoped object operations and ECS Exec channels.

This separation limits runtime IAM authority, but it does not hide injected secret values from application code. The app needs the database password to connect and can read its environment. A compromised application can therefore expose that password even without permission to call Secrets Manager. AWS documents the agent’s execution role; diagnose the actual operation before granting more authority.

Counter-questions

Would adding secret permission to the task role fix startup injection?

No. ECS performs that read using the execution role; the application has not started yet.

What does a trust policy control?

Who can assume the role. The role permission policy controls which operations the resulting credentials can perform.

Why not use one large role?

It obscures which caller needs each action and gives runtime code unnecessary authority. Separate roles make failures and security reviews more precise.

Where in MiniTickets

Read the path chapter, select the relevant map piece →, then inspect infra/src/compute/iam.ts → createIamRoles. Work through the related case for a diagnostic example.