aws / aws/aws-cdk

(ecs-patterns): allow specifying IAM-role for `EcsTask` through `ScheduledFargateTask`

Open
#22,673 5 comments 2 reactions 0 assignees View on GitHub
@aws-cdk/aws-ecs-patterns effort/small feature-request good first issue p2
Dominant language
TypeScript
Stars
12.9k
Forks
4.6k
Avg merge
2d 3h
Merged PRs (30d)
83

Description

### Describe the feature

Allow passing a IAM Role to `ScheduledFargateTask` which in turn is passed as the `role` argument to `EcsTask`.

### Use Case

The default IAM role created in `EcsTask` gets a policy for `ecs:RunTask` with the full task definition arn as the resource, that is with its revision. I want to be able to set a `ecs:RunTask` policy with a wild card as the task definition revision component, i.e instead of:
```python
PolicyStatement(
actions=["ecs:RunTask"],
resource=["arn:aws:ecs:XX:XX:task-definition/some-task-definition:42"],
...
)
```
I want:
```python
PolicyStatement(
actions=["ecs:RunTask"],
resource=["arn:aws:ecs:XX:XX:task-definition/some-task-definition:*"],
...
)
```

See: https://github.com/aws/aws-cdk/blob/66d1ed36b1628c116d5f1b3397688308d888c9de/packages/%40aws-cdk/aws-events-targets/lib/ecs-task.ts#L198-L204

### Proposed Solution

My proposal is to leverage the already existing `role` argument on `EcsTask` by simply adding the same argument to `ScheduledFargateTask` and passing it on through.

### Other Information

_No response_

### Acknowledgements

- [X] I may be able to implement this feature request
- [ ] This feature might incur a breaking change

### CDK version used

2.44

### Environment details (OS name and version, etc.)

MacOS 12.6.1

Contributor guide

Open the contributing guide

Research direction

Start in packages/@aws-cdk/aws-events-targets/lib/ecs-task.ts around the referenced EcsTask role handling and compare it with ScheduledFargateTask. Confirm how the existing role argument is defined, then trace the package’s related tests. Done means ScheduledFargateTask accepts the role and passes it through to EcsTask without changing the default behavior.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, typescript
Domain
cloud
Issue type
Feature
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.