feat(scheduler-targets): EcsRunTask scheduler target #33697

gracelu0 · 2025-03-06T01:03:51Z

Issue # (if applicable)

Closes #27456

Reason for this change

Currently the module supports all templated targets for EventBridge scheduler except for EcsRunTask.

Description of changes

Added new base class EcsRunTask with subclasses EcsRunFargateTask and EcsRunEc2Task depending on where user wants to schedule their ECS task. Decided on this design since some of the parameters in EcsParameters only apply one of Fargate or EC2.

Describe any new or updated permissions being added

Grant ecs:RunTask to the schedule execution role for the task definition and iam:passRole using existing grantRun() method (docs)

  this.props.taskDefinition.grantRun(role);

// TaskDefinition grant method 
  public grantRun(grantee: iam.IGrantable) {
    grantee.grantPrincipal.addToPrincipalPolicy(this.passRoleStatement);
    return iam.Grant.addToPrincipal({
      grantee,
      actions: ['ecs:RunTask'],
      resourceArns: [this.taskDefinitionArn],
    });
  }

//   passRoleStatement 
private get passRoleStatement() {
    if (!this._passRoleStatement) {
      this._passRoleStatement = new iam.PolicyStatement({
        effect: iam.Effect.ALLOW,
        actions: ['iam:PassRole'],
        resources: this.executionRole ? [this.taskRole.roleArn, this.executionRole.roleArn] : [this.taskRole.roleArn],
        conditions: {
          StringLike: { 'iam:PassedToService': 'ecs-tasks.amazonaws.com' },
        },
      });
    }

    return this._passRoleStatement;
  }

If tags are defined, grant ecs:TagResourceto the schedule execution tole for tasks in the cluster

    if (this.props.propagateTags === true || this.props.tags) {
      role.addToPrincipalPolicy(new PolicyStatement({
        actions: ['ecs:TagResource'],
        resources: [`arn:${this.cluster.stack.partition}:ecs:${this.cluster.env.region}:${this.props.taskDefinition.env.account}:task/${this.cluster.clusterName}/*`],
      }));
    }

Description of how you validated changes

Added unit tests and integration tests with assertions.

Checklist

My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

codecov · 2025-03-06T01:14:28Z

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 82.38%. Comparing base (2623e00) to head (08fc170).
Report is 3 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main   #33697   +/-   ##
=======================================
  Coverage   82.38%   82.38%           
=======================================
  Files         120      120           
  Lines        6937     6937           
  Branches     1170     1170           
=======================================
  Hits         5715     5715           
  Misses       1119     1119           
  Partials      103      103

Flag	Coverage Δ
suite.unit	`82.38% <ø> (ø)`

Flags with carried forward coverage won't be shown. Click here to find out more.

Components	Coverage Δ
packages/aws-cdk	`∅ <ø> (∅)`
packages/aws-cdk-lib/core	`82.38% <ø> (ø)`

🚀 New features to boost your workflow:

❄ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

godwingrs22

Thanks @gracelu0 for this great work. LGTM overall. Left few nits and comments for my understanding.

packages/@aws-cdk/aws-scheduler-targets-alpha/lib/ecs-run-task.ts

packages/@aws-cdk/aws-scheduler-targets-alpha/test/ecs-run-task.test.ts

godwingrs22 · 2025-03-06T22:58:32Z

packages/@aws-cdk/aws-scheduler-targets-alpha/test/ecs-run-task.test.ts

+      new scheduler.Schedule(stack, 'Schedule', {
+        schedule: scheduler.ScheduleExpression.rate(cdk.Duration.minutes(5)),
+        target: targets.EcsRunTask.onFargate(cluster, {
+          taskDefinition,
+          subnetSelection: { subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS },
+          securityGroups: [securityGroup],
+        }),
+      });


Can we a unit test for both fargate and ec2 task by calling like below also?

new scheduler.Schedule(stack, 'Schedule', { schedule: scheduler.ScheduleExpression.rate(cdk.Duration.minutes(5)), target: new targets.FargateTask(...) }); new scheduler.Schedule(stack, 'Schedule', { schedule: scheduler.ScheduleExpression.rate(cdk.Duration.minutes(5)), target: new targets.EC2Task(...) });

The API is intentionally designed to only support the static factory methods (EcsRunTask.onFargate() and EcsRunTask.onEc2()). The concrete classes (FargateTask and EC2Task) are implementation details and not part of the public API, so users can't directly instantiate them.

I recognize this isn't consistent with the other scheduler targets though (e.g. new targets.SqsSendMessage()) - so for consistency we could refactor as new targets.EcsRunFargateTask() and new targets.EcsRunEc2Task()

Yes i think we should expose this as public api as well so users can directly instantiate to be consistent with other scheduler targets. I'm good with the naming you suggested.

packages/@aws-cdk/aws-scheduler-targets-alpha/test/ecs-run-task.test.ts

packages/@aws-cdk/aws-scheduler-targets-alpha/lib/ecs-run-task.ts

godwingrs22

Thanks @gracelu0 for addressing the earlier comments. Left two comments to clarify on the validation.

godwingrs22 · 2025-03-18T18:59:57Z

packages/@aws-cdk/aws-scheduler-targets-alpha/lib/ecs-run-task.ts

+    if (this.props.taskDefinition.networkMode !== ecs.NetworkMode.AWS_VPC && (this.props.securityGroups || this.props.vpcSubnets)) {
+      throw new ValidationError('Security groups and subnets can only be used with awsvpc network mode', _schedule);
+    }


I'm not sure if this check is valid. Based on the CFN doc, it doesn't explicitly state that subnets or security groups should not be provided for other network modes.

I think it says as networkConfiguration is required for task definitions that use the awsvpc network mode. I know AWS_VPC network mode needs subnet and security group. But other network modes such as host or bridge i'm not sure if these subnets or secruity group can be used.

Please correct me if my understanding is wrong.

In that case, may be we should validate to check if the vpcSubnets is provided if aws_vpc network mode is used. since subnet is a required property on conditional basis.

if (this.props.taskDefinition.networkMode === ecs.NetworkMode.AWS_VPC && !this.props.vpcSubnets) { throw new ValidationError('Subnets must be specified when using awsvpc network mode', _schedule); }

The info seems to be scattered across multiple docs 😅 but here's another doc for AwsvpcConfiguration that says:

Properties AwsvpcConfiguration Specifies the Amazon VPC subnets and security groups for the task, and whether a public IP address is to be used. **This structure is relevant only for ECS tasks that use the awsvpc network mode.**

Based on that, my understanding is that for other network modes like 'host' or 'bridge', subnets and securityGroups should not be specified. I see in the stepfunctions-tasks module for ecs run-task we have some similar validation logic.

In that case, may be we should validate to check if the vpcSubnets is provided if aws_vpc network mode is used. since subnet is a required property on conditional basis.

We could add the validation or default to using the private subnets if user doesn't pass in any subnets and task definition is using AWS_VPC network mode:

const subnetSelection = this.subnetSelection || { subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS };

Setting a default for subnets is the current behaviour for Fargate, I can update EC2 with the same unless you think we should not set any default and instead enforce the user to provide a value.

packages/@aws-cdk/aws-scheduler-targets-alpha/lib/ecs-run-task.ts

aws-cdk-automation

(This review is outdated)

✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.

godwingrs22

Thanks @gracelu0. LGTM overall. Just one question for my understanding before i approve the PR.

godwingrs22 · 2025-03-19T19:30:18Z

packages/@aws-cdk/aws-scheduler-targets-alpha/lib/ecs-run-task.ts

            awsvpcConfiguration: {
-              subnets: this.cluster.vpc.selectSubnets(this.props.vpcSubnets).subnetIds,
-              securityGroups: this.props.securityGroups?.map((sg) => sg.securityGroupId),
+              subnets: this.cluster.vpc.selectSubnets(subnetSelection).subnetIds,
+              securityGroups: (this.props.securityGroups && this.props.securityGroups.length > 0)
+                ?
+                this.props.securityGroups.map((sg) => sg.securityGroupId)
+                : undefined,
            },


qq: For my understanding, is assignPublicIp feature not supported for EC2 based tasks ? I see we have it supported for Fargate based tasks. For ec2 based tasks, if the network mode is aws_vpc and subnet is a public subnet then users can still enable assignPublicIp right if they want to connect via public ip?

I based the implementation on the CloudFormation docs for AWS::Scheduler::Schedule AwsVpcConfiguration, it says under AssignPublicIp:

You can specify ENABLED only when LaunchType in EcsParameters is set to FARGATE.

Thank you for the clarification.

mergify · 2025-03-24T19:54:45Z

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

mergify · 2025-03-24T20:00:43Z

This pull request has been removed from the queue for the following reason: pull request branch update failed.

The pull request can't be updated

You should update or rebase your pull request manually.

If you want to requeue this pull request, you can post a @mergifyio requeue comment.

aws-cdk-automation · 2025-03-24T20:36:55Z

AWS CodeBuild CI Report

CodeBuild project: AutoBuildv2Project1C6BFA3F-wQm2hXv2jqQv
Commit ID: 66721c4
Result: SUCCEEDED
Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

mergify · 2025-03-24T20:37:19Z

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

github-actions · 2025-03-24T20:37:47Z

Comments on closed issues and PRs are hard for our team to see.
If you need help, please open a new issue that references this one.

aws-cdk-automation requested a review from a team March 6, 2025 01:04

github-actions bot added effort/medium Medium work item – several days of effort feature-request A feature should be added or improved. p2 labels Mar 6, 2025

mergify bot added the contribution/core This is a PR that came from AWS. label Mar 6, 2025

godwingrs22 self-assigned this Mar 6, 2025

gracelu0 force-pushed the ecs-run-task-scheduler-target branch 2 times, most recently from e97c70c to 109b25f Compare March 6, 2025 19:48

aws-cdk-automation added the pr/needs-maintainer-review This PR needs a review from a Core Team Member label Mar 6, 2025

gracelu0 changed the title ~~feat(scheduler-targets): ECSRunTask scheduler target~~ feat(scheduler-targets): EcsRunTask scheduler target Mar 6, 2025

godwingrs22 suggested changes Mar 6, 2025

View reviewed changes

aws-cdk-automation removed the pr/needs-maintainer-review This PR needs a review from a Core Team Member label Mar 6, 2025

gracelu0 force-pushed the ecs-run-task-scheduler-target branch 2 times, most recently from 947c4c6 to b0eb93a Compare March 17, 2025 17:41

shikha372 self-assigned this Mar 17, 2025

shikha372 reviewed Mar 17, 2025

View reviewed changes

packages/@aws-cdk/aws-scheduler-targets-alpha/lib/ecs-run-task.ts Show resolved Hide resolved

godwingrs22 reviewed Mar 18, 2025

View reviewed changes

aws-cdk-automation previously requested changes Mar 19, 2025

View reviewed changes

gracelu0 added 6 commits March 18, 2025 17:50

ecs runtask wip

65e6293

Add integration tests and readme

7604171

fix README

a60e30c

address comments

863b23d

allow awsvpc config for ec2 tasks and add fargate platform version type

6519994

make EcsRunTask classes public and add unit tests

08fc170

gracelu0 force-pushed the ecs-run-task-scheduler-target branch from 1c9c62c to 08fc170 Compare March 19, 2025 00:51

gracelu0 requested a review from godwingrs22 March 19, 2025 18:39

godwingrs22 reviewed Mar 19, 2025

View reviewed changes

godwingrs22 approved these changes Mar 19, 2025

View reviewed changes

godwingrs22 added pr/do-not-merge This PR should not be merged at this time. and removed pr/do-not-merge This PR should not be merged at this time. labels Mar 19, 2025

Merge branch 'main' into ecs-run-task-scheduler-target

66721c4

mergify bot merged commit 3fe58b5 into aws:main Mar 24, 2025
14 checks passed

github-actions bot locked as resolved and limited conversation to collaborators Mar 24, 2025

feat(scheduler-targets): EcsRunTask scheduler target #33697

feat(scheduler-targets): EcsRunTask scheduler target #33697

Uh oh!

Conversation

gracelu0 commented Mar 6, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Issue # (if applicable)

Reason for this change

Description of changes

Describe any new or updated permissions being added

Description of how you validated changes

Checklist

Uh oh!

codecov bot commented Mar 6, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

godwingrs22 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

godwingrs22 Mar 6, 2025

Choose a reason for hiding this comment

Uh oh!

gracelu0 Mar 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

godwingrs22 Mar 18, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

godwingrs22 left a comment

Choose a reason for hiding this comment

Uh oh!

godwingrs22 Mar 18, 2025

Choose a reason for hiding this comment

Uh oh!

gracelu0 Mar 18, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

aws-cdk-automation left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

godwingrs22 left a comment

Choose a reason for hiding this comment

Uh oh!

godwingrs22 Mar 19, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

gracelu0 Mar 19, 2025

Choose a reason for hiding this comment

Uh oh!

godwingrs22 Mar 19, 2025

Choose a reason for hiding this comment

Uh oh!

mergify bot commented Mar 24, 2025

Uh oh!

mergify bot commented Mar 24, 2025

Uh oh!

aws-cdk-automation commented Mar 24, 2025

AWS CodeBuild CI Report

Uh oh!

mergify bot commented Mar 24, 2025

Uh oh!

Uh oh!

github-actions bot commented Mar 24, 2025

Uh oh!

Reviewers

Assignees

Labels

gracelu0 commented Mar 6, 2025 •

edited

Loading

codecov bot commented Mar 6, 2025 •

edited

Loading

gracelu0 Mar 17, 2025 •

edited

Loading

aws-cdk-automation left a comment •

edited

Loading

godwingrs22 Mar 19, 2025 •

edited

Loading