Aster Retail enforces an SCP that denies iam:PassRole unless the role has the tag Approved=true. ECS in multiple accounts now fails to launch tasks because it needs to pass its service-linked role, which cannot be tagged. How should the security team modify the SCP to allow ECS while keeping the guardrail?

The correct solution leverages the iam:PassedToService condition key, which specifies the AWS service to which a role is being passed. By adding a condition to the Deny SCP that excludes requests where iam:PassedToService is ecs-tasks.amazonaws.com, the SCP will not block iam:PassRole actions when ECS is passing its service-linked role. This maintains the general guardrail for other roles while allowing ECS to function. Adding an explicit Allow for iam:PassRole on the ECS service-linked role ARN will not override an SCP Deny, as SCPs are evaluated before IAM policies and explicitly deny actions. Tagging service-linked roles is not possible, as they are managed by AWS. Attaching AdministratorAccess is a significant security risk and does not directly address the iam:PassRole SCP issue.