Generate an ECS execution role for each container #201

Dependency

• Bring the shared AWS platform under Terraform #184 — brings incubator-prod-ecs-task-role under Terraform. This issue replaces that role, so it cannot land first.
• Define the project tag standard #194 — the project tag standard, which defines what these roles get tagged with.

Overview

We need the container module to generate an ECS execution role for each container it creates, because all ten containers currently share a single hardcoded role. A shared role cannot be scoped to one project's resources, which is what the follow-on issue in this epic needs to do.

One role per container, not one per project — decided 2026-09-01 (Alex). The reason is developer ergonomics and symmetry: the module already generates a task role per container (aws_iam_role.instance), so generating the execution role alongside it means a project team adds a container and gets both roles automatically, with nothing to wire by hand and no shared object to reason about. A per-project role would have to be created elsewhere and passed in.

Terminology, because ECS overloads the word: "container" here means one invocation of the container module — one service and its task definition. It does not mean an ECS container instance, which is the EC2 host registered to the cluster and is a different resource entirely (see ecs-ec2-role).

Action Items

• Establish what the execution role genuinely needs in order to start a task: pulling the image from its project's ECR repository, writing to its own CloudWatch log group, and reading its project's SSM parameters. Nothing else.
• Replace the hardcoded execution_role_arn in terraform/modules/container/main.tf with a role created by the module, in the same shape and naming scheme as the aws_iam_role.instance task role immediately above it. Ten containers means ten execution roles.
• Tag each new role project = var.project_name at creation. The roles are per container but the tag is the project name, so several roles legitimately share a tag value — that is expected, and matches how the ten per-container task roles are tagged.
• Attach AmazonECSTaskExecutionRolePolicy or a scoped equivalent. Do not carry AmazonSSMFullAccess forward — narrowing it is the follow-on issue in this epic, and reproducing it here would defeat that.
• Roll this out one service at a time and confirm each task still starts. An execution role that cannot pull an image or read a secret fails the task before the container runs, which surfaces as an application fault rather than a permissions one — so a broken rollout is easy to misdiagnose.
• Decide what happens to the now-unused shared role incubator-prod-ecs-task-role, and to its stale Terragrunt-era tags terraform_managed = true and last_changed = Sat 2021-May-08. Do not delete the role in this issue — record the decision and raise it separately once nothing references it.
• After the PR merges, confirm every service is running its expected task count and that each task definition names its own project's execution role.

Resources/Instructions

• The hardcoded ARN is arn:aws:iam::035866691871:role/incubator-prod-ecs-task-role, set as execution_role_arn in terraform/modules/container/main.tf. Line numbers were accurate when this issue was written (2026-09-01) and may drift; find the code by the resource name if so.
• Naming trap. The shared role is named incubator-prod-ecs-task-role but is used as the execution role. The actual task roles are named ecs-container-*. The names are inverted relative to their function.
• The shared role has exactly two attachments today: AmazonECSTaskExecutionRolePolicy and AmazonSSMFullAccess.