(ecs): Allow passing executionRole to imported TaskDefinitions
- Dominant language
- TypeScript
- Stars
- 12.9k
- Forks
- 4.6k
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 83
Description
### Describe the feature
Currently, when importing a TaskDefinition, either via `TaskDefinition.fromTaskDefinitionAttributes` or `Fargate.fromFargateTaskDefinitionAttributes`, you can pass a `taskRole`, but not an `executionRole`.
In both cases, the `CommonTaskDefinitionAttributes` interface defines the attributes that can be passed when importing: https://github.com/aws/aws-cdk/blob/a98a98147534f89a219521a2e51a6a1e25a2ac06/packages/aws-cdk-lib/aws-ecs/lib/base/task-definition.ts#L231-L253
As you can see, you can pass `taskRole` but not `executionRole`.
### Use Case
I have a shared TaskDefinition that I use in other CDK apps. This TaskDefinition is triggered by an EventBridge rule. I share the TaskDefinition ARN, Task Role ARN (and Execution Role ARN) via `CfnOutput`s.
Since I use a custom image stored in ECR, my TaskDefinition has both a Task Role and an Execution Role. When creating the EventBridge rule, the `EcsTask` target needs to allow the `events` `ServicePrincipal` to `iam:PassRole` _both_ the Task Role and Execution Role for EventBridge to successfully `RunTask`.
The `EcsTask` target already has this logic: https://github.com/aws/aws-cdk/blob/a98a98147534f89a219521a2e51a6a1e25a2ac06/packages/aws-cdk-lib/aws-events-targets/lib/ecs-task.ts#L206-L213
However, because I can't pass the `executionRole` when I import the Task Definition, the logic to allow `PassRole` isn't added, and the EventBridge invocation fails.
I can work around this issue by forcing `taskDefinition.executionRole` assignment after the import:
```ts
(importedEcsTask.executionRole as any) = importedExecutionRole;
```
### Proposed Solution
Currently, these `.from` imports rely on the `ImportedTaskDefinition` class: https://github.com/aws/aws-cdk/blob/a98a98147534f89a219521a2e51a6a1e25a2ac06/packages/aws-cdk-lib/aws-ecs/lib/base/_imported-task-definition.ts
This class already exposes an `executionRole` property: https://github.com/aws/aws-cdk/blob/a98a98147534f89a219521a2e51a6a1e25a2ac06/packages/aws-cdk-lib/aws-ecs/lib/base/_imported-task-definition.ts#L53-L57
However, it's not exposed for setting in the static methods. I think we can just add `executionRole` as an optional parameter to the `CommonTaskDefinitionAttributes` interface and allow passing it through.
### Other Information
_No response_
### Acknowledgements
- [X] I may be able to implement this feature request
- [ ] This feature might incur a breaking change
### CDK version used
2.73.0
### Environment details (OS name and version, etc.)
macOS
Contributor guide
Research direction
Start in packages/aws-cdk-lib/aws-ecs/lib/base/task-definition.ts, where CommonTaskDefinitionAttributes is defined, and compare the import paths with packages/aws-cdk-lib/aws-ecs/lib/base/_imported-task-definition.ts. Then inspect packages/aws-cdk-lib/aws-events-targets/lib/ecs-task.ts and the existing import tests. Done means imported task definitions accept executionRole and EventBridge adds PassRole permissions for it.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, typescript
- Domain
- cloud, infrastructure
- Issue type
- Feature
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 58/100