Create an IAM Role for EventBridge to Run ECS Tasks

When an EventBridge Rule targets an ECS Task, it needs an IAM role that trusts events.amazonaws.com and has permission to run ECS tasks. Unlike Lambda targets (which use resource-based policies), ECS targets require an explicit IAM execution role ARN.

Paste into this field

EventBridge Rule → roleArn

Output looks like

arn:aws:iam::123456789012:role/EventBridgeECSExecutionRole

1Open IAM

Navigate to IAM → Roles → "Create role".

3Set the trusted service

Choose "AWS service" → from the dropdown select "EventBridge". This configures the trust policy automatically.

5Attach permissions

Search for and attach the AWS managed policy: AmazonECSTaskExecutionRolePolicy. Also attach an inline policy for RunTask:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["ecs:RunTask"],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": "iam:PassRole",
      "Resource": "*",
      "Condition": {
        "StringLike": {"iam:PassedToService": "ecs-tasks.amazonaws.com"}
      }
    }
  ]
}

8Name the role

Name it EventBridgeECSExecutionRole (or descriptive to your project).

10Copy the ARN

Click into the role → copy the ARN. Select your EventBridge Rule node on the canvas → open Advanced settings → paste the ARN into "IAM Role ARN (ECS / Step Functions targets)".

Once you have the value, go back to CloudStack Canvas and paste it into the highlighted field.

CloudStack Canvas · Validation Guide