Support ECS managed instances capacity provider.

.changeset/lovely-falcons-occur.md

@@ -0,0 +1,5 @@
+---
+"@guardian/cdk": minor
+---
+
+Support running on ECS Managed Instances instead of Fargate.

src/experimental/constructs/iam/roles/__snapshots__/ecs-managed-instances.test.ts.snap

@@ -0,0 +1,104 @@
+// Jest Snapshot v1, https://jestjs.io/docs/snapshot-testing
+
+exports[`GuECSManagedInstanceRole matches snapshot of the generated CloudFormation template 1`] = `
+{
+  "Metadata": {
+    "gu:cdk:constructs": [
+      "GuStack",
+      "GuECSManagedInstanceRoleExperimental",
+      "GuECSInstanceRolePolicyForManagedInstancesExperimental",
+    ],
+    "gu:cdk:version": "TEST",
+  },
+  "Resources": {
+    "ECSInstanceRole5196E36E": {
+      "Properties": {
+        "AssumeRolePolicyDocument": {
+          "Statement": [
+            {
+              "Action": "sts:AssumeRole",
+              "Effect": "Allow",
+              "Principal": {
+                "Service": "ec2.amazonaws.com",
+              },
+            },
+          ],
+          "Version": "2012-10-17",
+        },
+        "ManagedPolicyArns": [
+          "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly",
+        ],
+        "Tags": [
+          {
+            "Key": "gu:cdk:version",
+            "Value": "TEST",
+          },
+          {
+            "Key": "gu:repo",
+            "Value": "guardian/cdk",
+          },
+          {
+            "Key": "Stack",
+            "Value": "test-stack",
+          },
+          {
+            "Key": "Stage",
+            "Value": "TEST",
+          },
+        ],
+      },
+      "Type": "AWS::IAM::Role",
+    },
+    "ECSInstanceRolePolicyD0240271": {
+      "Properties": {
+        "PolicyDocument": {
+          "Statement": [
+            {
+              "Action": "ecs:DiscoverPollEndpoint",
+              "Effect": "Allow",
+              "Resource": "*",
+            },
+            {
+              "Action": "ecs:RegisterContainerInstance",
+              "Effect": "Allow",
+              "Resource": "arn:aws:ecs:eu-west-1:123456789012:cluster/test-cluster",
+            },
+            {
+              "Action": "ecs:Poll",
+              "Effect": "Allow",
+              "Resource": [
+                "arn:aws:ecs:*:*:container-instance/*",
+                "arn:aws:ecs:*:*:task-set/*",
+              ],
+            },
+            {
+              "Action": [
+                "ecs:StartTelemetrySession",
+                "ecs:PutSystemLogEvents",
+              ],
+              "Effect": "Allow",
+              "Resource": "arn:aws:ecs:*:*:container-instance/*",
+            },
+            {
+              "Action": [
+                "ecs:SubmitAttachmentStateChanges",
+                "ecs:SubmitTaskStateChange",
+              ],
+              "Effect": "Allow",
+              "Resource": "arn:aws:ecs:eu-west-1:123456789012:cluster/test-cluster",
+            },
+          ],
+          "Version": "2012-10-17",
+        },
+        "PolicyName": "ECSInstanceRolePolicyD0240271",
+        "Roles": [
+          {
+            "Ref": "ECSInstanceRole5196E36E",
+          },
+        ],
+      },
+      "Type": "AWS::IAM::Policy",
+    },
+  },
+}
+`;

src/experimental/constructs/iam/roles/ecs-managed-instances.test.ts

@@ -0,0 +1,66 @@
+import { Template } from "aws-cdk-lib/assertions";
+import { Cluster } from "aws-cdk-lib/aws-ecs";
+import { simpleGuStackForTesting } from "../../../../utils/test";
+import { GuECSManagedInstanceRoleExperimental } from "./ecs-managed-instances";
+
+describe("GuECSManagedInstanceRole", () => {
+  it("matches snapshot of the generated CloudFormation template", () => {
+    const stack = simpleGuStackForTesting();
+    const cluster = Cluster.fromClusterArn(
+      stack,
+      "testcluster",
+      "arn:aws:ecs:eu-west-1:123456789012:cluster/test-cluster",
+    );
+
+    new GuECSManagedInstanceRoleExperimental(stack, "ECSInstanceRole", {
+      cluster,
+    });
+
+    expect(Template.fromStack(stack).toJSON()).toMatchSnapshot();
+  });
+
+  it("creates a role that can be assumed by EC2", () => {
+    const stack = simpleGuStackForTesting();
+    const cluster = Cluster.fromClusterArn(
+      stack,
+      "testcluster",
+      "arn:aws:ecs:eu-west-1:123456789012:cluster/test-cluster",
+    );
+
+    new GuECSManagedInstanceRoleExperimental(stack, "ECSInstanceRole", {
+      cluster,
+    });
+
+    Template.fromStack(stack).hasResourceProperties("AWS::IAM::Role", {
+      AssumeRolePolicyDocument: {
+        Version: "2012-10-17",
+        Statement: [
+          {
+            Action: "sts:AssumeRole",
+            Effect: "Allow",
+            Principal: {
+              Service: "ec2.amazonaws.com",
+            },
+          },
+        ],
+      },
+    });
+  });
+
+  it("attaches the ECS managed policy for registry access", () => {
+    const stack = simpleGuStackForTesting();
+    const cluster = Cluster.fromClusterArn(
+      stack,
+      "testcluster",
+      "arn:aws:ecs:eu-west-1:123456789012:cluster/test-cluster",
+    );
+
+    new GuECSManagedInstanceRoleExperimental(stack, "ECSInstanceRole", {
+      cluster,
+    });
+
+    Template.fromStack(stack).hasResourceProperties("AWS::IAM::Role", {
+      ManagedPolicyArns: ["arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly"],
+    });
+  });
+});

src/experimental/constructs/iam/roles/ecs-managed-instances.ts

@@ -0,0 +1,45 @@
+import type { ICluster } from "aws-cdk-lib/aws-ecs";
+import { ManagedPolicy, ServicePrincipal } from "aws-cdk-lib/aws-iam";
+import type { GuStack } from "../../../../constructs/core";
+import { GuRole } from "../../../../constructs/iam";
+import { GuECSInstanceRolePolicyForManagedInstancesExperimental } from "../../policies/ecs-managed-instances-role-policy";
+
+export interface GuECSManagedInstanceRoleExperimentalProps {
+  /**
+   * ECS cluster that this role will be used with
+   */
+  cluster: ICluster;
+}
+
+/**
+ * Role for ECS Managed Instances that the ECS agent assumes to communicate
+ * with the Amazon ECS service.
+ *
+ * Scoped to a ECS cluster.
+ */
+export class GuECSManagedInstanceRoleExperimental extends GuRole {
+  constructor(scope: GuStack, id: string, props: GuECSManagedInstanceRoleExperimentalProps) {
+    // Allows the EC2 instance to pull images from the registry
+    const ecsRegistryPullPolicy = ManagedPolicy.fromManagedPolicyArn(
+      scope,
+      "ECSRegistryPullPolicy",
+      "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly",
+    );
+
+    super(scope, id, {
+      assumedBy: new ServicePrincipal("ec2.amazonaws.com"),
+      managedPolicies: [ecsRegistryPullPolicy],
+    });
+
+    // Allows the EC2 instance to register with the cluster and ECS
+    const ecsInstanceRolePolicy = new GuECSInstanceRolePolicyForManagedInstancesExperimental(
+      scope,
+      "ECSInstanceRolePolicy",
+      {
+        cluster: props.cluster,
+      },
+    );
+
+    ecsInstanceRolePolicy.attachToRole(this);
+  }
+}

src/experimental/constructs/iam/roles/index.ts

@@ -1 +1,2 @@
+export * from "./ecs-managed-instances";
 export * from "./fastly-kinesis-log";

src/experimental/constructs/policies/ecs-managed-instances-role-policy.test.ts

@@ -0,0 +1,55 @@
+import { Template } from "aws-cdk-lib/assertions";
+import { Cluster } from "aws-cdk-lib/aws-ecs";
+import { attachPolicyToTestRole, simpleGuStackForTesting } from "../../../utils/test";
+import { GuECSInstanceRolePolicyForManagedInstancesExperimental } from "./ecs-managed-instances-role-policy";
+
+describe("GuECSInstanceRolePolicyForManagedInstancesExperimental", () => {
+  it("creates a policy with correct ECS permissions for a specific cluster", () => {
+    const stack = simpleGuStackForTesting();
+
+    const cluster = Cluster.fromClusterArn(
+      stack,
+      "testcluster",
+      "arn:aws:ecs:eu-west-1:123456789012:cluster/test-cluster",
+    );
+
+    const policy = new GuECSInstanceRolePolicyForManagedInstancesExperimental(stack, "ECSPolicy", {
+      cluster,
+    });
+
+    attachPolicyToTestRole(stack, policy);
+
+    Template.fromStack(stack).hasResourceProperties("AWS::IAM::Policy", {
+      PolicyDocument: {
+        Version: "2012-10-17",
+        Statement: [
+          {
+            Action: "ecs:DiscoverPollEndpoint",
+            Effect: "Allow",
+            Resource: "*",
+          },
+          {
+            Action: "ecs:RegisterContainerInstance",
+            Effect: "Allow",
+            Resource: cluster.clusterArn,
+          },
+          {
+            Action: "ecs:Poll",
+            Effect: "Allow",
+            Resource: ["arn:aws:ecs:*:*:container-instance/*", "arn:aws:ecs:*:*:task-set/*"],
+          },
+          {
+            Action: ["ecs:StartTelemetrySession", "ecs:PutSystemLogEvents"],
+            Effect: "Allow",
+            Resource: "arn:aws:ecs:*:*:container-instance/*",
+          },
+          {
+            Action: ["ecs:SubmitAttachmentStateChanges", "ecs:SubmitTaskStateChange"],
+            Effect: "Allow",
+            Resource: cluster.clusterArn,
+          },
+        ],
+      },
+    });
+  });
+});

src/experimental/constructs/policies/ecs-managed-instances-role-policy.ts

@@ -0,0 +1,52 @@
+import type { ICluster } from "aws-cdk-lib/aws-ecs";
+import { Effect, PolicyStatement } from "aws-cdk-lib/aws-iam";
+import type { GuStack } from "../../../constructs/core";
+import { GuPolicy } from "../../../constructs/iam";
+
+export interface GuECSInstanceRolePolicyForManagedInstancesExperimentalProps {
+  /** Cluster the capacity provider is scoped to. */
+  cluster: ICluster;
+}
+
+/**
+ * Used by ECS Managed Instances to communicate with Amazon ECS service, scoped to a ECS cluster.
+ *
+ * Amazon provide a managed version of this policy but it is not scoped to a specific cluster, despite
+ * the fact that managed EC2 instances from a capacity provider can only be used with 1 cluster.
+ *
+ * See Amazons managed version:
+ * https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonECSInstanceRolePolicyForManagedInstances.html
+ */
+export class GuECSInstanceRolePolicyForManagedInstancesExperimental extends GuPolicy {
+  constructor(scope: GuStack, id: string, props: GuECSInstanceRolePolicyForManagedInstancesExperimentalProps) {
+    super(scope, id, {
+      statements: [
+        new PolicyStatement({
+          effect: Effect.ALLOW,
+          actions: ["ecs:DiscoverPollEndpoint"],
+          resources: ["*"],
+        }),
+        new PolicyStatement({
+          effect: Effect.ALLOW,
+          actions: ["ecs:RegisterContainerInstance"],
+          resources: [props.cluster.clusterArn],
+        }),
+        new PolicyStatement({
+          effect: Effect.ALLOW,
+          actions: ["ecs:Poll"],
+          resources: ["arn:aws:ecs:*:*:container-instance/*", "arn:aws:ecs:*:*:task-set/*"],
+        }),
+        new PolicyStatement({
+          effect: Effect.ALLOW,
+          actions: ["ecs:StartTelemetrySession", "ecs:PutSystemLogEvents"],
+          resources: ["arn:aws:ecs:*:*:container-instance/*"],
+        }),
+        new PolicyStatement({
+          effect: Effect.ALLOW,
+          actions: ["ecs:SubmitAttachmentStateChanges", "ecs:SubmitTaskStateChange"],
+          resources: [props.cluster.clusterArn],
+        }),
+      ],
+    });
+  }
+}