[service] [request]: Fine-grained IAM permission control for ECS UpdateService API

[yb-thai]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Tell us about your request

Request the ability to create more granular IAM permissions for the Amazon ECS UpdateService API. Specifically, need the option to grant a user or role permission to modify only the DesiredCount parameter of an ECS service, while preventing changes to any other service attributes.

Which service(s) is this request for?
ECS

Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard?

The existing IAM permissions for ecs:UpdateService are too broad, allowing users with this permission to modify multiple service parameters beyond just the DesiredCount.

Suggestion: Introduce a new condition key, i.e as "ecs:UpdateServiceParams", that would allow administrators to specify which parameters of the UpdateService API can be modified. This would enable the creation of IAM policies that restrict users to only updating the DesiredCount, while preventing modifications to other service attributes like task definition, deployment configuration, or network configuration.

Are you currently working around this issue?
Allow user/role to able to update all the parameters in ECS service.