IamPolicy

ARN of a custom IAM policy to attach to the application's ECS Task Role. If the Service has the Policies parameter set, this will not apply at the service level.

Use Cases

• Attach a custom IAM policy when your application needs to access AWS services such as S3, SQS, SNS, or DynamoDB
• Use when you want a single IAM policy shared across all Services in the application
• Use as a simpler alternative to defining per-service policies in convox.yml when all Services need the same permissions

Additional Information

The value must be a valid IAM policy ARN (e.g., arn:aws:iam::123456789012:policy/my-custom-policy). The policy is attached as a managed policy to the ECS Task Role that Convox creates for the application.

If a Service defines its own Policies attribute in convox.yml, the service-level policies take precedence and this app-level IamPolicy will not be applied to that Service. Services without explicit policies will use the app-level IamPolicy.

On a Rack with PermissionsBoundary set, the boundary caps the App's roles, so permissions in this policy beyond the boundary do not apply.

$ convox apps params set IamPolicy=arn:aws:iam::123456789012:policy/my-app-policy

See Also

• Services
• PermissionsBoundary
• Rack Parameters