fix(ecs): make TaskDefinition accept IRoles

The role input parameters are currently Roles but should be IRoles.

Required adding the grant methods to the `IRole` definition, which
weren't there before.

Fixes #1925.

packages/@aws-cdk/aws-ecs/lib/base/task-definition.ts

@@ -23,14 +23,14 @@ export interface CommonTaskDefinitionProps {
  *
  * @default An execution role will be automatically created if you use ECR images in your task definition
  */
- executionRole?: iam.Role;
+ executionRole?: iam.IRole;
 
  /**
  * The IAM role assumable by your application code running inside the container
  *
  * @default A task role is automatically created for you
  */
- taskRole?: iam.Role;
+ taskRole?: iam.IRole;
 
  /**
  * See: https://docs.aws.amazon.com/AmazonECS/latest/developerguide//task_definition_parameters.html#volumes
@@ -112,7 +112,7 @@ export class TaskDefinition extends cdk.Construct {
  /**
  * Task role used by this task definition
  */
- public readonly taskRole: iam.Role;
+ public readonly taskRole: iam.IRole;
 
  /**
  * Network mode used by this task definition

packages/@aws-cdk/aws-iam/lib/lazy-role.ts

@@ -1,5 +1,5 @@
 import cdk = require('@aws-cdk/cdk');
-import { Policy } from './policy';
+import { IPrincipal, Policy } from './policy';
 import { PolicyPrincipal, PolicyStatement } from './policy-document';
 import { IRole, Role, RoleImportProps, RoleProps } from './role';
 
@@ -85,6 +85,20 @@ export class LazyRole extends cdk.Construct implements IRole {
  return this.instantiate().principal;
  }
 
+ /**
+ * Grant the actions defined in actions to the identity Principal on this resource.
+ */
+ public grant(identity?: IPrincipal, ...actions: string[]): void {
+ return this.instantiate().grant(identity, ...actions);
+ }
+
+ /**
+ * Grant permissions to the given principal to pass this role.
+ */
+ public grantPassRole(identity?: IPrincipal): void {
+ return this.grantPassRole(identity);
+ }
+
  private instantiate(): Role {
  if (!this.role) {
  const role = new Role(this, 'Default', this.props);

packages/@aws-cdk/aws-iam/lib/role.ts

@@ -245,6 +245,16 @@ export interface IRole extends IConstruct, IPrincipal {
  * Export this role to another stack.
  */
  export(): RoleImportProps;
+
+ /**
+ * Grant the actions defined in actions to the identity Principal on this resource.
+ */
+ grant(identity?: IPrincipal, ...actions: string[]): void;
+
+ /**
+ * Grant permissions to the given principal to pass this role.
+ */
+ grantPassRole(identity?: IPrincipal): void;
 }
 
 function createAssumeRolePolicy(principal: PolicyPrincipal, externalId?: string) {
@@ -331,4 +341,18 @@ class ImportedRole extends Construct implements IRole {
  public attachManagedPolicy(_arn: string): void {
  // FIXME: Add warning that we're ignoring this
  }
+
+ /**
+ * Grant the actions defined in actions to the identity Principal on this resource.
+ */
+ public grant(_identity?: IPrincipal, ..._actions: string[]): void {
+ // FIXME: Add warning that we're ignoring this
+ }
+
+ /**
+ * Grant permissions to the given principal to pass this role.
+ */
+ public grantPassRole(_identity?: IPrincipal): void {
+ // FIXME: Add warning that we're ignoring this
+ }
 }