I have experience deploying to Fargate from ECR and we didn't need to configure any sort of S3 access to do it, certainly for the ExecutionRoleArn. ecr:BatchCheckLayerAvailability, ecr:BatchGetImage, and ecr:GetDownloadUrlForLayer on the ECR repos was sufficient.