aws-ecs-patterns: Allow user to be set for task definition

[robert-lilleker]

Describe the feature

I want to be able to use the ApplicationLoadBalancedFargateService construct and set the user that runs in the container as set out in the container definition in cloud formation

https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ecs-taskdefinition-containerdefinition.html#cfn-ecs-taskdefinition-containerdefinition-user

Use Case

I need to be able to set the container user for security reasons as it defaults to root when not set. There doesn't seem to be a way to do this with the existing ApplicationLoadBalancedFargateService construct

Proposed Solution

No response

Other Information

No response

Acknowledgements

• I may be able to implement this feature request
• This feature might incur a breaking change

AWS CDK Library version (aws-cdk-lib)

2.197.0

AWS CDK CLI version

2.197.0

Environment details (OS name and version, etc.)

Windows and linux code build in aws pipeline

[pahud]

Hi @robert-lilleker,

Thank you for opening this feature request. You've correctly identified that the ApplicationLoadBalancedFargateService construct in @aws-cdk/aws-ecs-patterns currently does not expose a direct way to specify the user for the container definition, leading to the container running as root by default.

The root cause is that the ApplicationLoadBalancedFargateServiceProps interface does not include a user property, and thus it's not passed to the underlying ContainerDefinition when it's created internally. You can see the relevant code in the ApplicationLoadBalancedFargateService class within the application-load-balanced-fargate-service.ts file, specifically around the addContainer call.

While we work on potentially adding this feature, there are two viable workarounds:

Workaround 1: Create Task Definition Separately
You can achieve the desired behavior by creating the FargateTaskDefinition and ContainerDefinition separately, and then passing the pre-configured taskDefinition to the ApplicationLoadBalancedFargateService. This approach allows you to fully control the TaskDefinition and ContainerDefinition properties, including the user property, before it's used by the ApplicationLoadBalancedFargateService construct.

Here's an example:

import { Stack, StackProps } from 'aws-cdk-lib';
import { Construct } from 'constructs';
import * as ecs from 'aws-cdk-lib/aws-ecs';
import * as ecs_patterns from 'aws-cdk-lib/aws-ecs-patterns';
import * as ec2 from 'aws-cdk-lib/aws-ec2';

interface MyStackProps extends StackProps {
  vpc: ec2.IVpc;
}

export class MyFargateServiceStack extends Stack {
  constructor(scope: Construct, id: string, props: MyStackProps) {
    super(scope, id, props);

    const cluster = new ecs.Cluster(this, 'MyCluster', {
      vpc: props.vpc,
    });

    // Create a Task Definition and specify the user
    const taskDefinition = new ecs.FargateTaskDefinition(this, 'MyTaskDef', {
      memoryLimitMiB: 512,
      cpu: 256,
    });

    taskDefinition.addContainer('MyContainer', {
      image: ecs.ContainerImage.fromRegistry('amazon/amazon-ecs-sample'),
      portMappings: [{ containerPort: 80 }],
      user: '1000', // Specify your desired user here
    });

    new ecs_patterns.ApplicationLoadBalancedFargateService(this, 'MyFargateService', {
      cluster,
      taskDefinition, // Pass the pre-configured task definition
      publicLoadBalancer: true,
    });
  }
}

Workaround 2: Using addPropertyOverride() A more advanced workaround involves using addPropertyOverride() to directly manipulate the underlying CloudFormation resource. This method allows you to set the User property on the CfnTaskDefinition after the ApplicationLoadBalancedFargateService construct has created it.

Here's an example:

import { Stack, StackProps } from 'aws-cdk-lib';
import { Construct } from 'constructs';
import * as ecs from 'aws-cdk-lib/aws-ecs';
import * as ecs_patterns from 'aws-cdk-lib/aws-ecs-patterns';
import * as ec2 from 'aws-cdk-lib/aws-ec2';

interface MyStackProps extends StackProps {
  vpc: ec2.IVpc;
}

export class MyFargateServiceStack extends Stack {
  constructor(scope: Construct, id: string, props: MyStackProps) {
    super(scope, id, props);

    const cluster = new ecs.Cluster(this, 'MyCluster', {
      vpc: props.vpc,
    });

    const fargateService = new ecs_patterns.ApplicationLoadBalancedFargateService(this, 'MyFargateService', {
      cluster,
      taskImageOptions: {
        image: ecs.ContainerImage.fromRegistry('amazon/amazon-ecs-sample'),
        containerPort: 80,
      },
      publicLoadBalancer: true,
    });

    // Access the underlying CfnTaskDefinition and override the 'User' property
    const cfnTaskDefinition = fargateService.taskDefinition.node.defaultChild as ecs.CfnTaskDefinition;
    cfnTaskDefinition.addPropertyOverride('ContainerDefinitions.0.User', '1000'); // Set your desired user here
  }
}

While addPropertyOverride() offers fine-grained control, the first workaround (creating the Task Definition separately) is generally recommended for its type safety and clarity.

We encourage contributions from our community! If you're interested in contributing this feature directly to the CDK, you can find the relevant code in the ApplicationLoadBalancedFargateService class within the packages/aws-cdk-lib/aws-ecs-patterns/lib/fargate/application-load-balanced-fargate-service.ts file. Specifically, the addContainer call needs to be updated to accept and pass through a user property from the construct's props.

Please let us know if you have any further questions or need assistance with these workarounds.

[robert-lilleker]

Thanks @pahud I'll have a look at the workarounds. I'll see about making the changes myself as I'm not a ts dev

[github-actions]

Comments on closed issues and PRs are hard for our team to see.
If you need help, please open a new issue that references this one.