Connect a Correctly-Trusted ECS Task Role

The IAM Role connected to your ECS Service (or directly to your Task Definition) does not trust the ecs-tasks.amazonaws.com service principal, so ECS can never actually assume it — every RunTask would fail even though the CloudFormation template itself deploys cleanly. Honest limitation: CloudStack Canvas has no property-panel field for an IAM Role's trust policy today (there is no "Assume Role Policy Document" editor to open) — a role's trust is set once, when the node is created, not edited afterward. The fix is to connect a DIFFERENT role that already has the correct trust policy, not to edit this one.

Paste into this field

No field to fill — reconnect to a role that already has ecs-tasks.amazonaws.com trust

Output looks like

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"Service":"ecs-tasks.amazonaws.com"},"Action":"sts:AssumeRole"}]} (already built into the auto-created "ECS Task Role" companion)

1Prefer the auto-created "ECS Task Role" companion

When you first dropped the ECS Service, CloudStack Canvas auto-created a companion IAM Role node labeled "ECS Task Role" — its trust policy is already correct out of the box. Check the IAM zone on your canvas: if that node is still there but not the one currently connected, reconnect your Service or Task Definition to IT instead.

3If the companion was deleted or reused elsewhere: duplicate a correctly-trusted role

Select any other IAM Role node on the canvas that you know has correct ecs-tasks trust (another ECS Service's own auto-created companion, or a role from a starter template) and duplicate it (Ctrl/Cmd+D). Connect the duplicate, then adjust its name/permissions as needed.

5Or start from a starter template

The "ECS Fargate Microservice" and "Highly Available Web App" starter templates already model an execution role AND a task role with correct ecs-tasks trust — use one as a base instead of building the ECS portion from scratch.

7Or import an existing role from AWS

If a correctly-trusted role already exists in your AWS account, use the CloudFormation/Terraform importer to bring it onto the canvas as an existing resource, then connect it.

9Verify

Re-open Export. The "trust policy does not allow ecs-tasks.amazonaws.com" warning should be gone, and the correctly-trusted role's ARN should now appear as TaskRoleArn in the generated template.

Once you have the value, go back to CloudStack Canvas and paste it into the highlighted field.

CloudStack Canvas · Validation Guide