Also, last time I checked IAM roles sucked on ECS. Not every container in the cluster should have the same role. I wonder if fargate fixes this.