Configure Permissions and IAM Role

In this section, you will configure the necessary execution permissions across two distinct boundaries: the Operating System level (Linux Sudoers) and the AWS IAM role. This ensures that the GitLab Runner can build Docker images and invoke AWS ECS APIs during automated deployment runs.

Architectural context

Our CI/CD pipeline runs directly on an EC2 build instance using the Shell Executor. To complete pipeline tasks, the runner requires authorized access at two levels:

  1. Linux sudoers: The GitLab Runner executes jobs under the unprivileged gitlab-runner system service account. It requires passwordless sudo (NOPASSWD) privileges to run privileged container commands and deploy scripts without hanging on password prompts.
  2. AWS IAM Instance Profile: The EC2 instance assumes an IAM Role (CustomRWECRRole). The AWS CLI v2 retrieves temporary security credentials automatically from the Instance Metadata Service (IMDSv2), eliminating the need to hardcode static AWS Access Keys in the repository.

Step 1: Configure sudo permissions for gitlab-runner

Because CI/CD jobs run non-interactively, any command requiring sudo will fail if a password prompt is triggered. We must configure passwordless sudo (NOPASSWD) for the gitlab-runner account.

  1. Open the sudoers configuration using the visudo command:

    sudo visudo

  2. Scroll to the bottom of the file and append the following entry:

    gitlab-runner ALL=(ALL) NOPASSWD:ALL

    Update Sudo

  3. Save and close the editor:

    • If using nano: Press Ctrl + O, then Enter to save, and Ctrl + X to exit.
    • If using vi/vim: Press Esc, type :wq, and press Enter.

Verify sudo permissions

Test that the gitlab-runner user can execute privileged commands without entering a password:

sudo -u gitlab-runner sudo whoami

Expected terminal output:

root

If the command outputs root without prompting for a password, your sudoers configuration is correct.

Step 2: Verify attached IAM role on EC2 instance

  1. Open the AWS Management Console and navigate to EC2 → Instances.

  2. Select your running build instance.

  3. In the Details pane below, look for IAM role:

    • Verify that the assigned role is CustomRWECRRole.
    • If the role is not attached, select Actions → Security → Modify IAM role, select CustomRWECRRole, and click Update IAM role.

    Verify EC2 IAM Role Modify IAM Role

Step 3: Attach required policies to IAM role

The build instance already has ECR read/write access via CustomRWECRRole. To deploy containerized services, it also requires permissions to manage ECS Task Definitions and trigger service updates.

  1. In the AWS Management Console search bar, enter IAM and open the IAM Dashboard.

  2. In the left navigation pane, select Roles.

  3. In the search box, type CustomRWECRRole and click on the role name to view its configuration.

    Access IAM

  4. In the Permissions tab, click Add permissions → Attach policies.

    Add Policy

  5. Search for and select the following AWS managed policies:

    • Search AmazonEC2FullAccess, check the box next to it.
    • Search AmazonECS_FullAccess, check the box next to it.
    • Click Add permissions to attach both policies to the role.

    Search EC2 Policy Search ECS Policy

  6. Your EC2 instance now has the necessary permissions to build Docker images and deploy containerized services to ECS. Policies Attached