I'm trying to pass ssm Parameters to Fargate and it's throwing the following error while provisioning:

Fetching secret data from SSM Parameter Store in ap-southeast-2: AccessDeniedException: User: <...> is not authorized to perform: ssm:GetParameters on resource: <...> status code: 400, request id: f13766c0-3c7b-46c7-9a34-5dd3b12f0e86

have you attached the ssm parameter policy to fargate? i haven’t used it, but if its the same as lambdas, you have to attach the policy to allow fargate to do things in the store…

So I attach that in Pulumi?

if you notice the

assumeRolePolicy

in https://www.pulumi.com/docs/reference/pkg/aws/lambda/permission/#basic-example should look something like

[
{
      "Action": [
        "ssm:GetParametersByPath",
        "ssm:GetParameter"
      ],
      "Effect": "Allow",
      "Resource": [
        "arn:aws:ssm:${region}:${accountId}:*",
        "arn:aws:ssm:${region}:${accountId}:parameter:*",
        "arn:aws:secretsmanager:${region}:${accountId}:secret:*"
      ]
    }, {
      "Action": [
        "secretsmanager:GetSecretValue"
      ],
      "Effect": "Allow",
      "Resource":[
        "arn:aws:secretsmanager:${region}:${accountId}:*",
        "arn:aws:secretsmanager:${region}:${accountId}:secret:*"
      ]
    }
]

for you…

Thank you

I’m not really sure, like i said, i’ve never used fargate with pulumi. sorry dude.

All good. Thanks