Give a Shared ECS Task Definition Its Own IAM Role

This Task Definition has no IAM Role of its own and is used by more than one ECS Service. Only the FIRST connected Service's role (and any S3/SQS/Secrets grants attached to it) is used to build the running task's TaskRoleArn — the other Service(s) sharing this Task Definition silently get no say in which permissions the task runs with. Connect an IAM Role directly to the Task Definition to make the grant explicit and unambiguous for every Service that uses it.

Paste into this field

No field to fill — draw an edge on the canvas

Output looks like

Canvas edge: IAM Role → ECS Task Definition

1Choose a role that already has the correct ecs-tasks trust

A role connected DIRECTLY to a Task Definition is used as-is, with no trust-policy check today, so pick one that is already correctly set up rather than a bare new one: duplicate (Ctrl/Cmd+D) the auto-created "ECS Task Role" companion node from one of this Task Definition's connected Services (its trust is already correct), or reuse a role from a starter template. CloudStack Canvas has no property-panel field to edit a role's trust or permissions after creation, so starting from a correctly-shaped role is the only reliable path — see the "Connect a Correctly-Trusted ECS Task Role" guide for the full option list.

3Draw the edge

Hover over the IAM Role node until handles appear. Drag from the Role to this Task Definition node.

5Verify

Re-open Export. The "shared by N ECS Services" warning should be gone, and TaskRoleArn in the generated template should reference this role directly.

Once you have the value, go back to CloudStack Canvas and paste it into the highlighted field.

CloudStack Canvas · Validation Guide