aws-cdk-lib/aws-ecs: Add task start up error logging to cdk output

[bytesnz-doc]

Describe the feature

To log ECS task start-up errors to the logs when running cdk deploy

Use Case

A cloudformation stack update can seem to hang if the update is failing to start an ECS task (for example if you forgot to give it permission to access and ECR repository). Instead of having to dig down to the ECS task, it would be great if these kind of errors were displayed when running cdk deploy so you can more instantly see there is an issue and do something about it.

Proposed Solution

Detect problems on task deployment/execution and log an error to the console running cdk deploy

Other Information

No response

Acknowledgements

• I may be able to implement this feature request
• This feature might incur a breaking change

AWS CDK Library version (aws-cdk-lib)

2.195.0

AWS CDK CLI version

2.1014.0

Environment details (OS name and version, etc.)

Windows and Linux

[wafuwafu13]

While validation for ECS-specific configurations is already in place, implementing validation for the overall architecture including VPC, IAM, etc. would be challenging due to the wide variety of possible configurations.
Implementing such validation across the entire aws/aws-cdk repository, rather than just for ECS, would significantly increase complexity.
Although the concept of configuration review during cdk deploy is a good idea.

[pahud]

Hi @bytesnz-doc,

Thank you for this interesting feature request! While the goal of improving developer experience is valuable, we need to carefully consider the architectural implications.

The CDK and CloudFormation primarily handle infrastructure provisioning, while application runtime monitoring (including task startup issues) traditionally belongs in the application monitoring layer. Adding application-level monitoring to the infrastructure layer could blur these boundaries.

We would love to hear more inputs from the community and I'll bring this up to the team for inputs as well.

[bytesnz-doc]

While validation for ECS-specific configurations is already in place, implementing validation for the overall architecture including VPC, IAM, etc. would be challenging due to the wide variety of possible configurations. Implementing such validation across the entire aws/aws-cdk repository, rather than just for ECS, would significantly increase complexity. Although the concept of configuration review during cdk deploy is a good idea.

It's not the validation as that won't be able to catch everything (I'm hoping to also be able to see failures for the container to start when the container exits before it becomes health.)

The CDK and CloudFormation primarily handle infrastructure provisioning, while application runtime monitoring (including task startup issues) traditionally belongs in the application monitoring layer. Adding application-level monitoring to the infrastructure layer could blur these boundaries.

Yeah, it would a little. It's just being able to see that the containers are failing and getting reprovisioned before they become healthy would be super helpful though