aws / aws/aws-cdk

aws_ecs: FargateTaskDefinition always adds default policy to execution role even when role is provided explicitly

Open
#35,785 3 comments 0 reactions 0 assignees View on GitHub
@aws-cdk/aws-ecs bug effort/medium p2
Dominant language
TypeScript
Stars
12.9k
Forks
4.6k
Avg merge
2d 3h
Merged PRs (30d)
83

Description

### Describe the bug

I want to manage the task execution policy my self such as its attached policies. In particular, I would like to attach metadata to specific policies to add cfn_nag ignore statements.
This is not work if policies are attached behind the scenes.
In addition, the docs do that state this behaviour

### Regression Issue

- [ ] Select this option if this issue appears to be a regression.

### Last Known Working CDK Library Version

_No response_

### Expected Behavior

CDK does not attach any inline policies to the provided task execution IAM role.

### Current Behavior

Even though all required permissions are already attached to the custom task execution role, CDK attaches the default execution policy.

### Reproduction Steps

Create a FargateTaskDefinition with your custom execution role with custom inline permissions. Once deployed, look at the attached inline policies of that role. There will be the default execution policy be attached.

### Possible Solution

Do not attach the default policy

### Additional Information/Context

_No response_

### AWS CDK Library version (aws-cdk-lib)

/local/home/****/***** └── (empty)

### AWS CDK CLI version

2.1030.0 (build e46adaf)

### Node.js Version

v24.5.0

### OS

Linux CentOS

### Language

Python

### Language Version

Python 3.12

### Other information

_No response_

Contributor guide

Open the contributing guide

Research direction

Start at the aws_ecs FargateTaskDefinition implementation and reproduce the issue with a custom execution role that already has inline permissions. Confirm the expected behavior by checking the synthesized or deployed role, and add or update coverage so a provided role receives no default execution policy.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, typescript
Domain
cloud, infrastructure
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.