fix(ecs-patterns): queue service grant permission automatically (#6110)

Co-authored-by: Piradeep Kandasamy <piradeep91@gmail.com> Co-authored-by: mergify[bot] <37929162+mergify[bot]@users.noreply.github.com>
aws · Feb 5, 2020 · 0d0794e · 0d0794e
1 parent d9a043b
commit 0d0794e
Show file tree

Hide file tree

Showing 4 changed files with 34 additions and 0 deletions.
diff --git a/packages/@aws-cdk/aws-ecs-patterns/lib/base/queue-processing-service-base.ts b/packages/@aws-cdk/aws-ecs-patterns/lib/base/queue-processing-service-base.ts
@@ -238,6 +238,14 @@ export abstract class QueueProcessingServiceBase extends Construct {
     });
   }
 
+  /**
+   * Grant SQS permissions to an ECS service.
+   * @param service the ECS/Fargate service to which to grant SQS permissions
+   */
+  protected grantPermissionsToService(service: BaseService) {
+    this.sqsQueue.grantConsumeMessages(service.taskDefinition.taskRole);
+  }
+
   /**
    * Returns the default cluster.
    */

diff --git a/packages/@aws-cdk/aws-ecs-patterns/lib/ecs/queue-processing-ecs-service.ts b/packages/@aws-cdk/aws-ecs-patterns/lib/ecs/queue-processing-ecs-service.ts
@@ -100,5 +100,6 @@ export class QueueProcessingEc2Service extends QueueProcessingServiceBase {
       enableECSManagedTags: props.enableECSManagedTags,
     });
     this.configureAutoscalingForService(this.service);
+    this.grantPermissionsToService(this.service);
   }
 }
diff --git a/packages/@aws-cdk/aws-ecs-patterns/lib/fargate/queue-processing-fargate-service.ts b/packages/@aws-cdk/aws-ecs-patterns/lib/fargate/queue-processing-fargate-service.ts
@@ -94,5 +94,6 @@ export class QueueProcessingFargateService extends QueueProcessingServiceBase {
       enableECSManagedTags: props.enableECSManagedTags,
     });
     this.configureAutoscalingForService(this.service);
+    this.grantPermissionsToService(this.service);
   }
 }
diff --git a/packages/@aws-cdk/aws-ecs-patterns/test/fargate/test.queue-processing-fargate-service.ts b/packages/@aws-cdk/aws-ecs-patterns/test/fargate/test.queue-processing-fargate-service.ts
@@ -29,6 +29,30 @@ export = {
 
     expect(stack).to(haveResource("AWS::SQS::Queue"));
 
+    expect(stack).to(haveResource("AWS::IAM::Policy",  {
+      PolicyDocument: {
+        Statement: [
+          {
+            Action: [
+              "sqs:ReceiveMessage",
+              "sqs:ChangeMessageVisibility",
+              "sqs:GetQueueUrl",
+              "sqs:DeleteMessage",
+              "sqs:GetQueueAttributes"
+            ],
+            Effect: "Allow",
+            Resource: {
+              "Fn::GetAtt": [
+                "ServiceEcsProcessingQueueC266885C",
+                "Arn"
+              ]
+            }
+          }
+        ],
+        Version: "2012-10-17"
+      }
+    }));
+
     expect(stack).to(haveResourceLike('AWS::ECS::TaskDefinition', {
       ContainerDefinitions: [
         {