title: AWS cli within task/container uses instance role policy and not task role
body: <p>If I use the aws cli from within a container on ECS then it appears that the IAM policy attached to the ECS instance role applies as it should but the task role IAM policy isn't used at all.</p>
  
  <p>Scenario:</p>
  
  <pre><code>aws s3 cp local/file s3://remotebucket
  </code></pre>
  
  <p>s3 PutObject policy attached to task role, not instance role - access denied</p>
  
  <p>s3 PutObject policy attached to instance role, not task role - success</p>
  
  <p>My understanding of IAM in tasks is that the container inherits the instance role, but also includes the policies from the task role? How can I get the first scenario to work?
  <a href="http://docs.aws.amazon.com/AmazonECS/latest/developerguide/task-iam-roles.html" rel="nofollow noreferrer">http://docs.aws.amazon.com/AmazonECS/latest/developerguide/task-iam-roles.html</a></p>