(aws-ecs-patterns): ECS Exec Support

[ghost]

Add ECS Exec Support to the higher level constructs in ecs-patterns

Use Case

As a user, I want to set the flag enableExecuteCommand: true in my aws-ecs-patterns.ApplicationLoadBalancedFargateService construct.

Proposed Solution

This is currently possible with the ecs module but not the ecs-patterns (see https://docs.aws.amazon.com/cdk/api/latest/docs/aws-ecs-readme.html#ecs-exec-command)

Relevant PRs: #13618
#14670

Solution would be to enable this flag in the higher level ecs-patterns constructs as well.

---

This is a 🚀 Feature Request

[ghost]

FYI, I found a workaround using Escape Hatches https://docs.aws.amazon.com/cdk/latest/guide/cfn_layer.html

My workaround is (Python) :

cfn_service = self.web_service.service.node.default_child
cfn_service.add_override("Properties.EnableExecuteCommand", True)

[danwiltshire]

@xavierbuspatrol Did you create other resources manually such as the IAM policy for ssmmessages, etc?

[richardnagle]

@danwiltshire I've got this, it's C# but hopefully will help:

        private static void EnableECSExec(ApplicationLoadBalancedFargateService service)
        {
            ((IConstruct) service.Service).Node.Children.OfType<CfnService>().First().EnableExecuteCommand = true;

            Permissions.ForRole(service.TaskDefinition.TaskRole)
                .GrantForAllResource("ssmmessages:CreateControlChannel")
                .GrantForAllResource("ssmmessages:CreateDataChannel")
                .GrantForAllResource("ssmmessages:OpenControlChannel")
                .GrantForAllResource("ssmmessages:OpenDataChannel");
        }

        private void EnableECSExecLogging(ApplicationLoadBalancedFargateService service)
        {
            var execLogs = new LogGroup(this, "ECSExecLogs", new LogGroupProps
            {
                LogGroupName = "ECS-Execute-Logs",
                Retention = RetentionDays.TWO_YEARS
            });

            service.Cluster.Node.Children.OfType<CfnCluster>().First().Configuration = new CfnCluster.ClusterConfigurationProperty
            {
                ExecuteCommandConfiguration = new CfnCluster.ExecuteCommandConfigurationProperty
                {
                    Logging = "OVERRIDE",
                    LogConfiguration = new CfnCluster.ExecuteCommandLogConfigurationProperty
                    {
                        CloudWatchLogGroupName = execLogs.LogGroupName
                    }
                }
            };
            
           Permissions.ForRole(service.TaskDefinition.TaskRole)
                .GrantForAllResource("logs:DescribeLogGroups")
                .Grant("logs:CreateLogStream", execLogs.LogGroupArn)
                .Grant("logs:DescribeLogStreams", execLogs.LogGroupArn)
                .Grant("logs:PutLogEvents", execLogs.LogGroupArn);
        }

[mzizzi]

Working on this one in #15497

Apologies for not giving a heads up ahead of time. I found this issue after working on a patch.

[camharris]

Here's how I handled this in typescript, maybe it's helpful for others. I added the AWS managed police for ssmmessages.

        const ecsDeployment = new ecs_patterns.ApplicationLoadBalancedFargateService(this, 'EcsPattern', {
          ....
        });

        // Add need policy for EnabledExecuteCommand
        ecsDeployment.taskDefinition.taskRole.addManagedPolicy(iam.ManagedPolicy.fromAwsManagedPolicyName('AmazonSSMManagedInstanceCore'))

        // Use escape hatch to add EnabledExecuteCommand to cf template
        const cfnService = ecsDeployment.service.node.defaultChild as ecs.CfnService;
        cfnService.addPropertyOverride('EnableExecuteCommand', true)
 

[wyjiao]

Here's how I handled this in typescript, maybe it's helpful for others. I added the AWS managed police for ssmmessages.

        const ecsDeployment = new ecs_patterns.ApplicationLoadBalancedFargateService(this, 'EcsPattern', {
          ....
        });

        // Add need policy for EnabledExecuteCommand
        ecsDeployment.taskDefinition.taskRole.addManagedPolicy(iam.ManagedPolicy.fromAwsManagedPolicyName('AmazonSSMManagedInstanceCore'))

        // Use escape hatch to add EnabledExecuteCommand to cf template
        const cfnService = ecsDeployment.service.node.defaultChild as ecs.CfnService;
        cfnService.addPropertyOverride('EnableExecuteCommand', true)
 

You can do "cfnService.enableExecuteCommand = true;" instead of addPropertyOverride since CloudFormation already supports the feature. This gives more type safety.

[kpeters-cbsi]

I tried this with QueueProcessingFargateService and got TypeError: Cannot set property 'enableExecuteCommand' of undefined

b0rked code:

   const service = new QueueProcessingFargateService(this, 'Service', {
       ....
   });
   // Kludge to enable execute command on this service
   const cfnService = service.node.defaultChild as CfnService
   cfnService.addPropertyOverride('EnableExecuteCommand', true) // barfs; cfnService is undefined

What I ended up having to do was find the FargateService instance and do node.defaultChild on that. Viz:

    const service = new QueueProcessingFargateService(this, 'Service', {
        ....
    });
    // Kludge to enable execute command on this service
    const fargateService = service.node.children.filter(
      (child) => child.constructor.name === 'FargateService'
    )[0] as FargateService
    const cfnService = fargateService.node.defaultChild as CfnService
    cfnService.enableExecuteCommand = true

[TheRealAmazonKendra]

Closed by #18663.

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.