Skip to content
Contrail logoContrail

AWS permissions

Contrail only reads from AWS unless you allow changes. If your SSO role is an admin or read-only role, you’re set for reading. Teammates with narrower roles need the permissions below: give the policy to whoever manages your SSO permission sets.

  • ContrailReadOnly: listing clusters, services, tasks and task definitions, reading log events and Live Tail. Without logs:StartLiveTail Contrail checks for new events every 2 seconds instead.
  • ContrailOptionalRevealSecrets: only to reveal secret values of environment variables. Narrow its Resource to the secrets your team may read. Each read shows up in CloudTrail.
  • ContrailOptionalInsightsTrace: only for “Use Logs Insights” when tracing across many services (billed per GB scanned).
  • ContrailOptionalChanges: only for stopping tasks and updating services from Contrail (desired count, revision, new deployment), with Allow changes to AWS on in the settings. Without it, a role can’t change anything, whatever the app does.
docs/iam-policy.json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ContrailReadOnly",
      "Effect": "Allow",
      "Action": [
        "sts:GetCallerIdentity",
        "ecs:ListClusters",
        "ecs:DescribeClusters",
        "ecs:ListServices",
        "ecs:DescribeServices",
        "ecs:ListTasks",
        "ecs:DescribeTasks",
        "ecs:DescribeTaskDefinition",
        "logs:FilterLogEvents",
        "logs:GetLogEvents",
        "logs:DescribeLogStreams",
        "logs:DescribeLogGroups",
        "logs:StartLiveTail"
      ],
      "Resource": "*"
    },
    {
      "Sid": "ContrailOptionalRevealSecrets",
      "Effect": "Allow",
      "Action": [
        "secretsmanager:GetSecretValue",
        "ssm:GetParameter",
        "kms:Decrypt"
      ],
      "Resource": "*"
    },
    {
      "Sid": "ContrailOptionalInsightsTrace",
      "Effect": "Allow",
      "Action": [
        "logs:StartQuery",
        "logs:GetQueryResults"
      ],
      "Resource": "*"
    },
    {
      "Sid": "ContrailOptionalChanges",
      "Effect": "Allow",
      "Action": [
        "ecs:StopTask",
        "ecs:UpdateService",
        "ecs:ListTaskDefinitions"
      ],
      "Resource": "*"
    }
  ]
}