What permissions do I need when creating an ECS agent using the Cloudformation stack?

[dagsir[bot]]

Hi all, I'm trying to create the <https://docs.dagster.io/dagster-cloud/deployment/agents/amazon-ecs/creating-ecs-agent-new-vpc#prerequisites|ECS agent> using the CF stack, and I'm running into permissions issues trying to set up the ECS role. I tried using arn:aws:iam::<account>:role/aws-service-role/ecs.amazonaws.com/AWSServiceRoleForECS and got AWSServiceRoleForECS is invalid or cannot be assumed, so maybe I need a role that CF has permissions to assume as the principal?

---

The question was originally asked in Dagster Slack.

[prha]

Not tested, but it looks like there might be a few workarounds you might be able to try here: https://stackoverflow.com/a/68384249? Maybe going to the ECS console manually after the initial deployment attempt might work?