AWS docker容器未继承主机实例角色

Question

我正在尝试从在ECS中部署的docker容器中运行的Camel路由器访问S3存储桶。

主机EC2实例具有IAM策略，可以访问S3存储桶，我已经通过直接在EC2中运行独立路由器来验证这一点。但是当我在一个容器中尝试该程序时，它会抛出一个异常，说明＆＃34;访问被拒绝＆＃34;到S3桶。

在此之后，我尝试通过在我的Cloudformation中添加TaskRoleArn来提供Task IAM角色，但这并没有帮助，仍然是同样的例外。

不确定我在这里遗漏了什么，有什么建议吗？

[编辑，在此处添加IAM政策] 这是我对主机的IAM策略，类似于我为Task Role创建的策略以及与'ecs-tasks.amazonaws.com'的信任关系

这是我对主持人的IAM政策，类似我为“任务角色”创建的政策以及与“ecs-tasks.amazonaws.com”的信任关系

EC2Role:
Type: AWS::IAM::Role
Properties:
  AssumeRolePolicyDocument:
    Statement:
    - Effect: Allow
      Principal:
        Service:
        - ec2.amazonaws.com
        - ecs.amazonaws.com
      Action:
      - sts:AssumeRole
  Path: /Developer/
  Policies:
  - PolicyName: ecs-service
    PolicyDocument:
      Statement:
      - Effect: Allow
        Action:
        - logs:CreateLogStream
        - logs:CreateLogGroup 
        - logs:DescribeLogGroups
        - logs:DescribeLogStreams
        - logs:PutLogEvents
        - logs:GetLogEvents
        - logs:FilterLogEvents
        Resource: '*'
  - PolicyName: ep-bucket-policy
    PolicyDocument:
      Statement:
      - Sid: bucket1
        Effect: Allow
        Action:
        - s3:GetObject
        - s3:GetObjectAcl
        - s3:AbortMultipartUpload
        - s3:GetObjectTagging
        - s3:DeleteObject
        - s3:ListMultipartUploadParts
        Resource: *
      - Sid: bucket2
        Effect: Allow
        Action: s3:ListObjects
        Resource: "*"
  - PolicyName: ep-ecr-policy
    PolicyDocument:
      Statement:
      - Sid: ecr1
        Effect: Allow
        Action:
        - ecr:BatchCheckLayerAvailability
        - ecr:GetDownloadUrlForLayer
        - ecr:GetRepositoryPolicy
        - ecr:DescribeRepositories
        - ecr:ListImages
        - ecr:BatchGetImage
        Resource:
        - !Sub 'arn:aws:ecr:${AWS::Region}:${AWS::AccountId}:repository/*’
      - Sid: ecr2
        Effect: Allow
        Action:
        - ecr:GetAuthorizationToken   
        Resource: '*'
  - PolicyName: ep-ecs-policy
    PolicyDocument:
      Statement:
      - Sid: ecs1
        Effect: Allow
        Action:
        - ecs:SubmitTaskStateChange
        - ecs:RegisterContainerInstance
        - ecs:SubmitContainerStateChange
        - ecs:DeregisterContainerInstance
        Resource: !Sub 'arn:aws:ecs:${AWS::Region}:${AWS::AccountId}:cluster/Custom-*’
      - Sid: ecs2
        Effect: Allow
        Action:
        - ecs:Poll
        - ecs:DiscoverPollEndpoint
        - ecs:StartTelemetrySession
        - ecs:CreateCluster
        Resource: "*"