ECS's IAM Condition Keys Now Cover RunTask and StartTask Too!

Hi everyone, it's me, Shiichan! Today's news tightens up ECS permission management a bit.

AWS What's New aws.amazon.com

What was announced?

AWS What's New announced that Amazon Elastic Container Service (ECS) now supports the IAM condition keys for CPU and memory resources on the RunTask and StartTask APIs.

The story so far

Until now, the ecs:task-cpu and ecs:task-memory condition keys only worked on three APIs: RegisterTaskDefinition, CreateService, and UpdateService. That meant you could enforce limits when registering task definitions or launching through a service, but tasks launched directly via RunTask or StartTask slipped past those limits — a quietly annoying gap for administrators.

What changes

This update extends both condition keys to the RunTask and StartTask APIs.

• IAM policies referencing these condition keys are now evaluated when tasks launch through RunTask and StartTask too
• CPU and memory limits apply consistently no matter how a task is launched — task definition, service, RunTask, or StartTask
• Administrators get a single, unified mechanism for controlling resource allocation across their ECS environment

That's a real win for organizations trying to prevent unexpected cost overruns or keep workloads aligned with their resource policies.

Dive Deep

This extension is available in every AWS region where Amazon ECS runs, at no additional cost. For more on using condition keys with ECS, check the official documentation.

Wrap-up

• Amazon ECS's ecs:task-cpu and ecs:task-memory condition keys now cover the RunTask and StartTask APIs.
• Previously, only RegisterTaskDefinition, CreateService, and UpdateService were covered.
• CPU and memory limits now apply consistently regardless of how a task is launched.
• It's available at no extra cost in every region where ECS runs.
• A useful upgrade for ECS administrators and SREs looking to tighten cost guardrails on container workloads.