Adding IAM policy to S3 bucket for a Fargate taskRole across stacks

[franck102]

Hi all,

I am creating a Fargate service in one stack, and S3 buckets in another. I am trying to add a policy to the buckets to allow access from the task, however CDK complains that I need to physically name my service's task taskRole to use it across stacks.
Is that what I should do, or is there a better / easier way to allow Get/Put access to the S3 buckets from the service task?

The policy code looks like this:

const bucket = new s3.Bucket(this, "Bucket", {
                bucketName: bucketName,
                removalPolicy: cdk.RemovalPolicy.DESTROY,
                autoDeleteObjects: true,
            })

            bucket.addToResourcePolicy(new iam.PolicyStatement({
                resources: [
                    bucket.arnForObjects("*"),
                    bucket.bucketArn
                ],
                actions: ["s3:List*", "s3:Get*", "s3:Put*"],
                principals: [props.taskRole]  // props.taskRoleArn doesn't work either
            }))

            this.tenantBuckets.set(tenant, bucket);
        }

Thanks!