ECS Tasks can be assigned IAM Roles to make it possible to communicate with AWS APIs without having to pass user credentials to the Task. This works for both AWS CLI and SDK. There is quite good documentation here but I couldn't find a proper example that covers all the details, I'll create a self-answer question to spare the pain for others.