feat(ecs): Adding support for ECS Exec

packages/@aws-cdk/aws-ecs/README.md

@@ -850,3 +850,60 @@ taskDefinition.addContainer('cont', {
   inferenceAcceleratorResources,
 });
 ```
+
+## ECS Exec command
+
+Please note, ECS Exec leverages AWS Systems Manager (SSM). So as a prerequisite for the exec command
+to work, you need to have the SSM plugin for the AWS CLI installed locally. For more information, see
+[Install Session Manager plugin for AWS CLI] (https://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager-working-with-install-plugin.html).
+
+To enable the ECS Exec feature for your containers, set the boolean flag `enableExecuteCommand` to `true` in
+your `Ec2Service` or `FargateService`.
+
+```ts
+const service = new ecs.Ec2Service(stack, 'Service', {
+  cluster,
+  taskDefinition,
+  enableExecuteCommand: true,
+});
+```
+
+### Enabling logging
+
+You can enable sending logs of your execute session commands to a CloudWatch log group or S3 bucket by configuring
+the `executeCommandConfiguration` property for your cluster. The default configuration will send the
+logs to the CloudWatch Logs using the `awslogs` log driver that is configured in your task definition. Please note,
+when using your own `logConfiguration` the log group or S3 Bucket specified must already be created. 
+
+To encrypt data using your own KMS Customer Key (CMK), you must create a CMK and provide the key in the `kmsKey` field
+of the `executeCommandConfiguration`. To use this key for encrypting CloudWatch log data or S3 bucket, make sure to associate the key
+to these resources on creation. 
+
+```ts
+const kmsKey = new kms.Key(stack, 'KmsKey');
+
+// Pass the KMS key in the `encryptionKey` field to associate the key to the log group
+const logGroup = new logs.LogGroup(stack, 'LogGroup', {
+  encryptionKey: kmsKey,
+});
+
+// Pass the KMS key in the `encryptionKey` field to associate the key to the S3 bucket
+const execBucket = new s3.Bucket(stack, 'EcsExecBucket', {
+  encryptionKey: kmsKey,
+});
+
+const cluster = new ecs.Cluster(stack, 'Cluster', {
+  vpc,
+  executeCommandConfiguration: {
+    kmsKey,
+    logConfiguration: {
+      cloudWatchLogGroup: logGroup,
+      cloudWatchEncryptionEnabled: true,
+      s3Bucket: execBucket,
+      s3EncryptionEnabled: true,
+      s3KeyPrefix: 'exec-command-output',
+    },
+    logging: ecs.ExecuteCommandLogging.OVERRIDE,
+  },
+});
+```

packages/@aws-cdk/aws-ecs/lib/base/base-service.ts

@@ -8,7 +8,7 @@ import * as cloudmap from '@aws-cdk/aws-servicediscovery';
 import { Annotations, Duration, IResolvable, IResource, Lazy, Resource, Stack } from '@aws-cdk/core';
 import { Construct } from 'constructs';
 import { LoadBalancerTargetOptions, NetworkMode, TaskDefinition } from '../base/task-definition';
-import { ICluster, CapacityProviderStrategy } from '../cluster';
+import { ICluster, CapacityProviderStrategy, ExecuteCommandLogging } from '../cluster';
 import { ContainerDefinition, Protocol } from '../container-definition';
 import { CfnService } from '../ecs.generated';
 import { ScalableTaskCount } from './scalable-task-count';
@@ -189,6 +189,13 @@ export interface BaseServiceOptions {
    *
    */
   readonly capacityProviderStrategies?: CapacityProviderStrategy[];
+
+  /**
+   * Whether to enable the ability to execute into a container
+   *
+   *  @default - undefined
+   */
+  readonly enableExecuteCommand?: boolean;
 }
 
 /**
@@ -391,6 +398,7 @@ export abstract class BaseService extends Resource
         type: DeploymentControllerType.ECS,
       } : props.deploymentController,
       launchType: launchType,
+      enableExecuteCommand: props.enableExecuteCommand,
       capacityProviderStrategy: props.capacityProviderStrategies,
       healthCheckGracePeriodSeconds: this.evaluateHealthGracePeriod(props.healthCheckGracePeriod),
       /* role: never specified, supplanted by Service Linked Role */
@@ -416,6 +424,18 @@ export abstract class BaseService extends Resource
       this.enableCloudMap(props.cloudMapOptions);
     }
 
+    if (props.enableExecuteCommand) {
+      this.enableExecuteCommand();
+
+      const logging = this.cluster.executeCommandConfiguration?.logging ?? ExecuteCommandLogging.DEFAULT;
+
+      if (this.cluster.executeCommandConfiguration?.kmsKey) {
+        this.enableExecuteCommandEncryption(logging);
+      }
+      if (logging !== ExecuteCommandLogging.NONE) {
+        this.executeCommandLogConfiguration();
+      }
+    }
     this.node.defaultChild = this.resource;
   }
 
@@ -426,6 +446,84 @@ export abstract class BaseService extends Resource
     return this.cloudmapService;
   }
 
+  private executeCommandLogConfiguration() {
+    const logConfiguration = this.cluster.executeCommandConfiguration?.logConfiguration;
+    this.taskDefinition.addToTaskRolePolicy(new iam.PolicyStatement({
+      actions: [
+        'logs:DescribeLogGroups',
+      ],
+      resources: ['*'],
+    }));
+
+    const logGroupArn = logConfiguration?.cloudWatchLogGroup ? `arn:aws:logs:${this.stack.region}:${this.stack.account}:log-group:${logConfiguration.cloudWatchLogGroup.logGroupName}:*` : '*';
+    this.taskDefinition.addToTaskRolePolicy(new iam.PolicyStatement({
+      actions: [
+        'logs:CreateLogStream',
+        'logs:DescribeLogStreams',
+        'logs:PutLogEvents',
+      ],
+      resources: [logGroupArn],
+    }));
+
+    if (logConfiguration?.s3Bucket?.bucketName) {
+      this.taskDefinition.addToTaskRolePolicy(new iam.PolicyStatement({
+        actions: [
+          's3:GetBucketLocation',
+        ],
+        resources: ['*'],
+      }));
+      this.taskDefinition.addToTaskRolePolicy(new iam.PolicyStatement({
+        actions: [
+          's3:PutObject',
+        ],
+        resources: [`arn:aws:s3:::${logConfiguration.s3Bucket.bucketName}/*`],
+      }));
+      if (logConfiguration.s3EncryptionEnabled) {
+        this.taskDefinition.addToTaskRolePolicy(new iam.PolicyStatement({
+          actions: [
+            's3:GetEncryptionConfiguration',
+          ],
+          resources: [`arn:aws:s3:::${logConfiguration.s3Bucket.bucketName}`],
+        }));
+      }
+    }
+  }
+
+  private enableExecuteCommandEncryption(logging: ExecuteCommandLogging) {
+    this.taskDefinition.addToTaskRolePolicy(new iam.PolicyStatement({
+      actions: [
+        'kms:Decrypt',
+        'kms:GenerateDataKey',
+      ],
+      resources: [`${this.cluster.executeCommandConfiguration?.kmsKey?.keyArn}`],
+    }));
+
+    this.cluster.executeCommandConfiguration?.kmsKey?.addToResourcePolicy(new iam.PolicyStatement({
+      actions: [
+        'kms:*',
+      ],
+      resources: ['*'],
+      principals: [new iam.ArnPrincipal(`arn:aws:iam::${this.stack.account}:root`)],
+    }));
+
+    if (logging === ExecuteCommandLogging.DEFAULT || this.cluster.executeCommandConfiguration?.logConfiguration?.cloudWatchEncryptionEnabled) {
+      this.cluster.executeCommandConfiguration?.kmsKey?.addToResourcePolicy(new iam.PolicyStatement({
+        actions: [
+          'kms:Encrypt*',
+          'kms:Decrypt*',
+          'kms:ReEncrypt*',
+          'kms:GenerateDataKey*',
+          'kms:Describe*',
+        ],
+        resources: ['*'],
+        principals: [new iam.ServicePrincipal(`logs.${this.stack.region}.amazonaws.com`)],
+        conditions: {
+          ArnLike: { 'kms:EncryptionContext:aws:logs:arn': `arn:aws:logs:${this.stack.region}:${this.stack.account}:*` },
+        },
+      }));
+    }
+  }
+
   /**
    * This method is called to attach this service to an Application Load Balancer.
    *
@@ -790,6 +888,18 @@ export abstract class BaseService extends Resource
       produce: () => providedHealthCheckGracePeriod?.toSeconds() ?? (this.loadBalancers.length > 0 ? 60 : undefined),
     });
   }
+
+  private enableExecuteCommand() {
+    this.taskDefinition.addToTaskRolePolicy(new iam.PolicyStatement({
+      actions: [
+        'ssmmessages:CreateControlChannel',
+        'ssmmessages:CreateDataChannel',
+        'ssmmessages:OpenControlChannel',
+        'ssmmessages:OpenDataChannel',
+      ],
+      resources: ['*'],
+    }));
+  }
 }
 
 /**