aws_ecs: FargateTaskDefinition always adds default policy to execution role even when role is provided explicitly
- Dominant language
- TypeScript
- Stars
- 12.9k
- Forks
- 4.6k
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 83
Description
### Describe the bug
I want to manage the task execution policy my self such as its attached policies. In particular, I would like to attach metadata to specific policies to add cfn_nag ignore statements.
This is not work if policies are attached behind the scenes.
In addition, the docs do that state this behaviour
### Regression Issue
- [ ] Select this option if this issue appears to be a regression.
### Last Known Working CDK Library Version
_No response_
### Expected Behavior
CDK does not attach any inline policies to the provided task execution IAM role.
### Current Behavior
Even though all required permissions are already attached to the custom task execution role, CDK attaches the default execution policy.
### Reproduction Steps
Create a FargateTaskDefinition with your custom execution role with custom inline permissions. Once deployed, look at the attached inline policies of that role. There will be the default execution policy be attached.
### Possible Solution
Do not attach the default policy
### Additional Information/Context
_No response_
### AWS CDK Library version (aws-cdk-lib)
/local/home/****/***** └── (empty)
### AWS CDK CLI version
2.1030.0 (build e46adaf)
### Node.js Version
v24.5.0
### OS
Linux CentOS
### Language
Python
### Language Version
Python 3.12
### Other information
_No response_
Contributor guide
Research direction
Start at the aws_ecs FargateTaskDefinition implementation and reproduce the issue with a custom execution role that already has inline permissions. Confirm the expected behavior by checking the synthesized or deployed role, and add or update coverage so a provided role receives no default execution policy.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, typescript
- Domain
- cloud, infrastructure
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100