aws / aws/aws-cdk

(ecs): Allow passing executionRole to imported TaskDefinitions

Open
#24,984 3 comments 0 reactions 0 assignees View on GitHub
@aws-cdk/aws-ecs effort/small feature-request p2
Dominant language
TypeScript
Stars
12.9k
Forks
4.6k
Avg merge
2d 3h
Merged PRs (30d)
83

Description

### Describe the feature

Currently, when importing a TaskDefinition, either via `TaskDefinition.fromTaskDefinitionAttributes` or `Fargate.fromFargateTaskDefinitionAttributes`, you can pass a `taskRole`, but not an `executionRole`.

In both cases, the `CommonTaskDefinitionAttributes` interface defines the attributes that can be passed when importing: https://github.com/aws/aws-cdk/blob/a98a98147534f89a219521a2e51a6a1e25a2ac06/packages/aws-cdk-lib/aws-ecs/lib/base/task-definition.ts#L231-L253

As you can see, you can pass `taskRole` but not `executionRole`.

### Use Case

I have a shared TaskDefinition that I use in other CDK apps. This TaskDefinition is triggered by an EventBridge rule. I share the TaskDefinition ARN, Task Role ARN (and Execution Role ARN) via `CfnOutput`s.

Since I use a custom image stored in ECR, my TaskDefinition has both a Task Role and an Execution Role. When creating the EventBridge rule, the `EcsTask` target needs to allow the `events` `ServicePrincipal` to `iam:PassRole` _both_ the Task Role and Execution Role for EventBridge to successfully `RunTask`.

The `EcsTask` target already has this logic: https://github.com/aws/aws-cdk/blob/a98a98147534f89a219521a2e51a6a1e25a2ac06/packages/aws-cdk-lib/aws-events-targets/lib/ecs-task.ts#L206-L213

However, because I can't pass the `executionRole` when I import the Task Definition, the logic to allow `PassRole` isn't added, and the EventBridge invocation fails.

I can work around this issue by forcing `taskDefinition.executionRole` assignment after the import:

```ts
(importedEcsTask.executionRole as any) = importedExecutionRole;
```

### Proposed Solution

Currently, these `.from` imports rely on the `ImportedTaskDefinition` class: https://github.com/aws/aws-cdk/blob/a98a98147534f89a219521a2e51a6a1e25a2ac06/packages/aws-cdk-lib/aws-ecs/lib/base/_imported-task-definition.ts

This class already exposes an `executionRole` property: https://github.com/aws/aws-cdk/blob/a98a98147534f89a219521a2e51a6a1e25a2ac06/packages/aws-cdk-lib/aws-ecs/lib/base/_imported-task-definition.ts#L53-L57

However, it's not exposed for setting in the static methods. I think we can just add `executionRole` as an optional parameter to the `CommonTaskDefinitionAttributes` interface and allow passing it through.

### Other Information

_No response_

### Acknowledgements

- [X] I may be able to implement this feature request
- [ ] This feature might incur a breaking change

### CDK version used

2.73.0

### Environment details (OS name and version, etc.)

macOS

Contributor guide

Open the contributing guide

Research direction

Start in packages/aws-cdk-lib/aws-ecs/lib/base/task-definition.ts, where CommonTaskDefinitionAttributes is defined, and compare the import paths with packages/aws-cdk-lib/aws-ecs/lib/base/_imported-task-definition.ts. Then inspect packages/aws-cdk-lib/aws-events-targets/lib/ecs-task.ts and the existing import tests. Done means imported task definitions accept executionRole and EventBridge adds PassRole permissions for it.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, typescript
Domain
cloud, infrastructure
Issue type
Feature
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
58/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.