Your ECS task pulls a private image from ECR, sends logs to CloudWatch, and the NestJS code inside writes to an SQS queue. Where does the sqs:SendMessage permission belong?

The task role gives credentials to your application code, so sqs:SendMessage belongs there.

The option "In the task execution role, because it is the role ECS uses to run the task" is the common mistake. ECS itself uses the task execution role to pull the image, write logs and fetch secrets named in the task definition. Your app code does not use it.

"In an IAM user whose access keys are injected as environment variables" is also wrong. Long-lived access keys in env vars defeat the point of roles.