Broken Example: fargate-service-with-ecs

[johncmunson]

Broken Example: fargate-service-with-ecs

[thierryweo]

same problem here

[johncmunson]

To rule out any potential weirdness with the AWS account I was using, I creating a fresh account and tried again.

The example is still broken and fails with the same error mentioned above.

[mrlikl]

I was able to deploy the sample by adding ClientMount permission to the EFS file system policy

fileSystem.addToResourcePolicy(
      new iam.PolicyStatement({
        actions: ['elasticfilesystem:ClientMount'],
        principals: [new iam.AnyPrincipal()],
        conditions: {
          Bool: {
            'elasticfilesystem:AccessedViaMountTarget': 'true'
          }
        }
      })
    )

[johncmunson]

Thank you @mrlikl, that did indeed fix the example.

Although, it's frustrating to be mucking around with IAM policies in this scenario. I was under the impression that CDK abstracts away some of this stuff by wiring up least-privileged policies, especially when working with higher level L2 constructs.

The code below clearly shows that the Fargate tasks have a dependency on the EFS file system. Seems to me like CDK should understand the dependency tree and automatically create least-privileged IAM policies so that the resources can talk to one another.

const taskDef = new ecs.FargateTaskDefinition(this, "MyTaskDefinition", {
  memoryLimitMiB: 512,
  cpu: 256,
  volumes: [
    {
      name: "uploads",
      efsVolumeConfiguration: {
        fileSystemId: fileSystem.fileSystemId,
      },
    },
  ],
});

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.