(ecs): Allow passing executionRole to imported TaskDefinitions

[blimmer]

Describe the feature

Currently, when importing a TaskDefinition, either via TaskDefinition.fromTaskDefinitionAttributes or Fargate.fromFargateTaskDefinitionAttributes, you can pass a taskRole, but not an executionRole.

In both cases, the CommonTaskDefinitionAttributes interface defines the attributes that can be passed when importing:

aws-cdk/packages/aws-cdk-lib/aws-ecs/lib/base/task-definition.ts

Lines 231 to 253 in a98a981

	/**
	* The common task definition attributes used across all types of task definitions.
	*/
	export interface CommonTaskDefinitionAttributes {
	/**
	* The arn of the task definition
	*/
	readonly taskDefinitionArn: string;
	/**
	* The networking mode to use for the containers in the task.
	*
	* @default Network mode cannot be provided to the imported task.
	*/
	readonly networkMode?: NetworkMode;
	/**
	* The name of the IAM role that grants containers in the task permission to call AWS APIs on your behalf.
	*
	* @default Permissions cannot be granted to the imported task.
	*/
	readonly taskRole?: iam.IRole;
	}

As you can see, you can pass taskRole but not executionRole.

Use Case

I have a shared TaskDefinition that I use in other CDK apps. This TaskDefinition is triggered by an EventBridge rule. I share the TaskDefinition ARN, Task Role ARN (and Execution Role ARN) via CfnOutputs.

Since I use a custom image stored in ECR, my TaskDefinition has both a Task Role and an Execution Role. When creating the EventBridge rule, the EcsTask target needs to allow the events ServicePrincipal to iam:PassRole both the Task Role and Execution Role for EventBridge to successfully RunTask.

The EcsTask target already has this logic:

aws-cdk/packages/aws-cdk-lib/aws-events-targets/lib/ecs-task.ts

Lines 206 to 213 in a98a981

	// If it so happens that a Task Execution Role was created for the TaskDefinition,
	// then the EventBridge Role must have permissions to pass it (otherwise it doesn't).
	if (this.taskDefinition.executionRole !== undefined) {
	policyStatements.push(new iam.PolicyStatement({
	actions: ['iam:PassRole'],
	resources: [this.taskDefinition.executionRole.roleArn],
	}));
	}

However, because I can't pass the executionRole when I import the Task Definition, the logic to allow PassRole isn't added, and the EventBridge invocation fails.

I can work around this issue by forcing taskDefinition.executionRole assignment after the import:

(importedEcsTask.executionRole as any) = importedExecutionRole;

Proposed Solution

Currently, these .from imports rely on the ImportedTaskDefinition class: https://github.com/aws/aws-cdk/blob/a98a98147534f89a219521a2e51a6a1e25a2ac06/packages/aws-cdk-lib/aws-ecs/lib/base/_imported-task-definition.ts

This class already exposes an executionRole property:

aws-cdk/packages/aws-cdk-lib/aws-ecs/lib/base/_imported-task-definition.ts

Lines 53 to 57 in a98a981

	/**
	* Execution role for this task definition
	*/
	readonly executionRole?: IRole = undefined;

However, it's not exposed for setting in the static methods. I think we can just add executionRole as an optional parameter to the CommonTaskDefinitionAttributes interface and allow passing it through.

Other Information

No response

Acknowledgements

• I may be able to implement this feature request
• This feature might incur a breaking change

CDK version used

2.73.0

Environment details (OS name and version, etc.)

macOS

[blimmer]

Fix proposed with #24987

[pahud]

Makes sense to me and thank you for your PR!

[deeTEEcee]

any idea why i get this error? it seems like it's saying that we don't have a taskRole in this task definition object either...

"Error: This operation requires the taskRole in ImportedTaskDefinition to be defined. Add the 'taskRole' in ImportedTaskDefinitionProps to instantiate ImportedTaskDefinition
at ImportedTaskDefinition.get taskRole [as taskRole]"

const taskDef: ecs.IFargateTaskDefinition = ecs.FargateTaskDefinition.fromFargateTaskDefinitionArn(this, "pasture-task-definition", "<insert arn>");
const passRoleResources = [taskDef.taskRole.roleArn] # Leads to error