add assume role policy

Author: timburke-hackit

terraform/modules/department/50-aws-iam-policies.tf

@@ -960,3 +960,14 @@ resource "aws_iam_policy_document" "department_ecs_policy" {
   policy = data.aws_iam_policy_document.department_ecs.json
   tags   = var.tags
 }
+
+data "aws_iam_policy_document" "ecs_assume_role_policy" {
+  statement {
+    effect = "allow"
+    principals {
+      identifiers = ["ecs-tasks.amazonaws.com"]
+      type        = "Service"
+    }
+    actions = "sts:AssumeRole"
+  }
+}

terraform/modules/department/50-aws-iam-roles.tf

@@ -143,7 +143,7 @@ resource "aws_secretsmanager_secret_version" "airflow_user_secret_version" {
 # Department ECS
 resource "aws_iam_role" "department_ecs_role" {
   name               = lower("${var.identifier_prefix}-glue-${local.department_identifier}")
-  assume_role_policy = data.aws_iam_policy_document.department
+  assume_role_policy = data.aws_iam_policy_document.ecs_assume_role_policy.json
   tags               = var.tags
 }