I'm trying to set up an ECS Fargate job to run based on a Cloudwatch trigger, specifically a Cloudwatch scheduled (cron) trigger. I have an ECS cluster set up, and when I manually create an ECS Fargate task on my cluster then the job runs fine without error. I also have a Cloudwatch cron trigger set up, and I can see in the Cloudwatch metrics that the trigger is being set off the way I configured it. The problem I'm having is that these two things are not talking to each other. I'm getting FailedInvocations in my Cloudwatch metrics dashboard, but as far as I can tell I can't find any logs as to what is failing.

Can someone provide me some details as to what I might need to set this up? I'm doing this using Terraform, so a Terraform-based solution would be most helpful.

I've tried fiddling around with IAM roles and permissions but I'm not quite sure what IAM roles and policies I need, or even if IAM is my problem. I also noticed that the Cloudwatch trigger has a role, and also the Cloudwatch task execution has a role; I've tried various things for both of these but not sure what role (in the task ecosystem) each of these IAM roles plays so I don't know what permissions are required for each one.

Thanks!