Skip to content

Commit 2d9078c

Browse files
lpizzinidevlpizzinidev
authored
fix(ecs): potential race condition on TaskRole default policy update with CfnService (#26070)
Prevents potential race conditions on TaskRole default policy update in EC2 and Fargate services by adding a dependency on the TaskRole. This will update the TaskRole and its children first and the service after. Closes #24880. ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
1 parent 939dc84 commit 2d9078c

File tree

170 files changed

+3746
-2128
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

170 files changed

+3746
-2128
lines changed

‎packages/@aws-cdk-testing/framework-integ/test/aws-codepipeline-actions/test/integ.pipeline-ecs-deploy.js.snapshot/aws-cdk-codepipeline-ecs-deploy.template.json

+4-2
Original file line numberDiff line numberDiff line change
@@ -297,7 +297,8 @@
297297
"TaskDefinition": {
298298
"Ref": "TaskDef54694570"
299299
}
300-
}
300+
},
301+
"DependsOn": ["TaskDefTaskRole1EDB4A67"]
301302
},
302303
"FargateServiceSecurityGroup0A0E79CB": {
303304
"Type": "AWS::EC2::SecurityGroup",
@@ -313,7 +314,8 @@
313314
"VpcId": {
314315
"Ref": "VPCB9E5F0B4"
315316
}
316-
}
317+
},
318+
"DependsOn": ["TaskDefTaskRole1EDB4A67"]
317319
},
318320
"MyBucketF68F3FF0": {
319321
"Type": "AWS::S3::Bucket",

‎packages/@aws-cdk-testing/framework-integ/test/aws-ecs-patterns/test/ec2/integ.alb-ecs-service-command-entry-point.js.snapshot/aws-ecs-integ-alb-ec2-cmd-entrypoint.template.json

+2-1
Original file line numberDiff line numberDiff line change
@@ -868,7 +868,8 @@
868868
},
869869
"DependsOn": [
870870
"ALBECSServiceWithCommandEntryPointLBPublicListenerECSGroup7271102D",
871-
"ALBECSServiceWithCommandEntryPointLBPublicListener1DCF0F84"
871+
"ALBECSServiceWithCommandEntryPointLBPublicListener1DCF0F84",
872+
"ALBECSServiceWithCommandEntryPointTaskDefTaskRoleD0EE621C"
872873
]
873874
}
874875
},

‎packages/@aws-cdk-testing/framework-integ/test/aws-ecs-patterns/test/ec2/integ.application-load-balanced-ecs-service.js.snapshot/aws-ecs-integ-alb.template.json

+2-1
Original file line numberDiff line numberDiff line change
@@ -1065,7 +1065,8 @@
10651065
},
10661066
"DependsOn": [
10671067
"myServiceLBPublicListenerECSGroup17E9BBC1",
1068-
"myServiceLBPublicListenerC78AE8A0"
1068+
"myServiceLBPublicListenerC78AE8A0",
1069+
"myServiceTaskDefTaskRole1C1DE6CC"
10691070
]
10701071
}
10711072
},

‎packages/@aws-cdk-testing/framework-integ/test/aws-ecs-patterns/test/ec2/integ.healthchecks-multiple-application-load-balanced-ecs-service.js.snapshot/aws-ecs-integ-multiple-alb-healthchecks.template.json

+2-1
Original file line numberDiff line numberDiff line change
@@ -1284,7 +1284,8 @@
12841284
"myServicelb1listener1ECSTargetGroupweb80GroupC3F9339A",
12851285
"myServicelb1listener15ED0E805",
12861286
"myServicelb2listener2ECSTargetGroupweb90Group6841F924",
1287-
"myServicelb2listener2AA6970EB"
1287+
"myServicelb2listener2AA6970EB",
1288+
"myServiceTaskDefTaskRole1C1DE6CC"
12881289
]
12891290
}
12901291
},

‎packages/@aws-cdk-testing/framework-integ/test/aws-ecs-patterns/test/ec2/integ.healthchecks-multiple-network-load-balanced-ecs-service.js.snapshot/aws-ecs-integ-nlb-healthchecks.template.json

+2-1
Original file line numberDiff line numberDiff line change
@@ -1120,7 +1120,8 @@
11201120
"myServicelb1listener1ECSTargetGroupweb80GroupC3F9339A",
11211121
"myServicelb1listener15ED0E805",
11221122
"myServicelb2listener2ECSTargetGroupweb90Group6841F924",
1123-
"myServicelb2listener2AA6970EB"
1123+
"myServicelb2listener2AA6970EB",
1124+
"myServiceTaskDefTaskRole1C1DE6CC"
11241125
]
11251126
}
11261127
},

‎packages/@aws-cdk-testing/framework-integ/test/aws-ecs-patterns/test/ec2/integ.multiple-application-load-balanced-ecs-service-idle-timeout.js.snapshot/aws-ecs-integ-alb-idle-timeout.template.json

+3-1
Original file line numberDiff line numberDiff line change
@@ -1500,7 +1500,9 @@
15001500
"myServicelb2listener2ECSTargetGroupweb443Group8FAB1268",
15011501
"myServicelb2listener2ECSTargetGroupweb80Group0590BDE6",
15021502
"myServicelb2listener2ECSTargetGroupweb80Rule2490715C",
1503-
"myServicelb2listener2AA6970EB"
1503+
"myServicelb2listener2AA6970EB",
1504+
"myServiceTaskDefTaskRoleDefaultPolicyD48473C0",
1505+
"myServiceTaskDefTaskRole1C1DE6CC"
15041506
]
15051507
}
15061508
},

‎packages/@aws-cdk-testing/framework-integ/test/aws-ecs-patterns/test/ec2/integ.multiple-application-load-balanced-ecs-service.js.snapshot/aws-ecs-integ-multiple-alb.template.json

+3-1
Original file line numberDiff line numberDiff line change
@@ -1213,7 +1213,9 @@
12131213
"myServiceLBPublicListenerECSTargetGroupweb80GroupCA306BD0",
12141214
"myServiceLBPublicListenerECSTargetGroupweb90Group6388E5B5",
12151215
"myServiceLBPublicListenerECSTargetGroupweb90Rule0CAA997D",
1216-
"myServiceLBPublicListenerC78AE8A0"
1216+
"myServiceLBPublicListenerC78AE8A0",
1217+
"myServiceTaskDefTaskRoleDefaultPolicyD48473C0",
1218+
"myServiceTaskDefTaskRole1C1DE6CC"
12171219
]
12181220
}
12191221
},

‎packages/@aws-cdk-testing/framework-integ/test/aws-ecs-patterns/test/ec2/integ.network-load-balanced-ecs-service.js.snapshot/aws-ecs-integ-nlb.template.json

+2-1
Original file line numberDiff line numberDiff line change
@@ -1024,7 +1024,8 @@
10241024
},
10251025
"DependsOn": [
10261026
"myServiceLBPublicListenerECSGroup17E9BBC1",
1027-
"myServiceLBPublicListenerC78AE8A0"
1027+
"myServiceLBPublicListenerC78AE8A0",
1028+
"myServiceTaskDefTaskRole1C1DE6CC"
10281029
]
10291030
}
10301031
},

‎packages/@aws-cdk-testing/framework-integ/test/aws-ecs-patterns/test/fargate/integ.alb-fargate-service-command-entry-point.js.snapshot/aws-ecs-integ-lb-fargate-cmd-entrypoint-test.template.json

+6-3
Original file line numberDiff line numberDiff line change
@@ -677,7 +677,8 @@
677677
},
678678
"DependsOn": [
679679
"ALBFargateServiceWithCommandAndEntryPointLBPublicListenerECSGroupBAD40305",
680-
"ALBFargateServiceWithCommandAndEntryPointLBPublicListener6589DC80"
680+
"ALBFargateServiceWithCommandAndEntryPointLBPublicListener6589DC80",
681+
"ALBFargateServiceWithCommandAndEntryPointTaskDefTaskRole65CE9392"
681682
]
682683
},
683684
"ALBFargateServiceWithCommandAndEntryPointServiceSecurityGroupD154E880": {
@@ -694,7 +695,8 @@
694695
"VpcId": {
695696
"Ref": "Vpc8378EB38"
696697
}
697-
}
698+
},
699+
"DependsOn": ["ALBFargateServiceWithCommandAndEntryPointTaskDefTaskRole65CE9392"]
698700
},
699701
"ALBFargateServiceWithCommandAndEntryPointServiceSecurityGroupfromawsecsinteglbfargatecmdentrypointtestALBFargateServiceWithCommandAndEntryPointLBSecurityGroup886E70918046DDBFE6": {
700702
"Type": "AWS::EC2::SecurityGroupIngress",
@@ -715,7 +717,8 @@
715717
]
716718
},
717719
"ToPort": 80
718-
}
720+
},
721+
"DependsOn": ["ALBFargateServiceWithCommandAndEntryPointTaskDefTaskRole65CE9392"]
719722
}
720723
},
721724
"Outputs": {

‎packages/@aws-cdk-testing/framework-integ/test/aws-ecs-patterns/test/fargate/integ.alb-fargate-service-https-idle-timeout.js.snapshot/aws-ecs-integ-alb-fg-idletimeout.template.json

+13-3
Original file line numberDiff line numberDiff line change
@@ -787,7 +787,9 @@
787787
},
788788
"DependsOn": [
789789
"myServiceLBPublicListenerECSGroup17E9BBC1",
790-
"myServiceLBPublicListenerC78AE8A0"
790+
"myServiceLBPublicListenerC78AE8A0",
791+
"myServiceTaskDefTaskRoleDefaultPolicyD48473C0",
792+
"myServiceTaskDefTaskRole1C1DE6CC"
791793
]
792794
},
793795
"myServiceSecurityGroupC3B9D4E0": {
@@ -804,7 +806,11 @@
804806
"VpcId": {
805807
"Ref": "Vpc8378EB38"
806808
}
807-
}
809+
},
810+
"DependsOn": [
811+
"myServiceTaskDefTaskRoleDefaultPolicyD48473C0",
812+
"myServiceTaskDefTaskRole1C1DE6CC"
813+
]
808814
},
809815
"myServiceSecurityGroupfromawsecsintegalbfgidletimeoutmyServiceLBSecurityGroup1B078E6280039B9A1C": {
810816
"Type": "AWS::EC2::SecurityGroupIngress",
@@ -825,7 +831,11 @@
825831
]
826832
},
827833
"ToPort": 80
828-
}
834+
},
835+
"DependsOn": [
836+
"myServiceTaskDefTaskRoleDefaultPolicyD48473C0",
837+
"myServiceTaskDefTaskRole1C1DE6CC"
838+
]
829839
}
830840
},
831841
"Outputs": {

‎packages/@aws-cdk-testing/framework-integ/test/aws-ecs-patterns/test/fargate/integ.alb-fargate-service-https.js.snapshot/aws-ecs-integ-alb-fg-https.template.json

+13-3
Original file line numberDiff line numberDiff line change
@@ -783,7 +783,9 @@
783783
},
784784
"DependsOn": [
785785
"myServiceLBPublicListenerECSGroup17E9BBC1",
786-
"myServiceLBPublicListenerC78AE8A0"
786+
"myServiceLBPublicListenerC78AE8A0",
787+
"myServiceTaskDefTaskRoleDefaultPolicyD48473C0",
788+
"myServiceTaskDefTaskRole1C1DE6CC"
787789
]
788790
},
789791
"myServiceSecurityGroupC3B9D4E0": {
@@ -800,7 +802,11 @@
800802
"VpcId": {
801803
"Ref": "Vpc8378EB38"
802804
}
803-
}
805+
},
806+
"DependsOn": [
807+
"myServiceTaskDefTaskRoleDefaultPolicyD48473C0",
808+
"myServiceTaskDefTaskRole1C1DE6CC"
809+
]
804810
},
805811
"myServiceSecurityGroupfromawsecsintegalbfghttpsmyServiceLBSecurityGroupA934AF89808E9FB7A3": {
806812
"Type": "AWS::EC2::SecurityGroupIngress",
@@ -821,7 +827,11 @@
821827
]
822828
},
823829
"ToPort": 80
824-
}
830+
},
831+
"DependsOn": [
832+
"myServiceTaskDefTaskRoleDefaultPolicyD48473C0",
833+
"myServiceTaskDefTaskRole1C1DE6CC"
834+
]
825835
}
826836
},
827837
"Outputs": {

‎packages/@aws-cdk-testing/framework-integ/test/aws-ecs-patterns/test/fargate/integ.asset-image.js.snapshot/aws-ecs-integ-fargate-image.template.json

+6-3
Original file line numberDiff line numberDiff line change
@@ -707,7 +707,8 @@
707707
},
708708
"DependsOn": [
709709
"FargateServiceLBPublicListenerECSGroupBE57E081",
710-
"FargateServiceLBPublicListener4B4929CA"
710+
"FargateServiceLBPublicListener4B4929CA",
711+
"FargateServiceTaskDefTaskRole8CDCF85E"
711712
]
712713
},
713714
"FargateServiceSecurityGroup262B61DD": {
@@ -724,7 +725,8 @@
724725
"VpcId": {
725726
"Ref": "Vpc8378EB38"
726727
}
727-
}
728+
},
729+
"DependsOn": ["FargateServiceTaskDefTaskRole8CDCF85E"]
728730
},
729731
"FargateServiceSecurityGroupfromawsecsintegfargateimageFargateServiceLBSecurityGroup04156A428000D3E717F0": {
730732
"Type": "AWS::EC2::SecurityGroupIngress",
@@ -745,7 +747,8 @@
745747
]
746748
},
747749
"ToPort": 8000
748-
}
750+
},
751+
"DependsOn": ["FargateServiceTaskDefTaskRole8CDCF85E"]
749752
}
750753
},
751754
"Outputs": {

‎packages/@aws-cdk-testing/framework-integ/test/aws-ecs-patterns/test/fargate/integ.circuit-breaker-load-balanced-fargate-service.js.snapshot/aws-ecs-integ-circuit-breaker.template.json

+6-3
Original file line numberDiff line numberDiff line change
@@ -676,7 +676,8 @@
676676
},
677677
"DependsOn": [
678678
"myServiceLBPublicListenerECSGroup17E9BBC1",
679-
"myServiceLBPublicListenerC78AE8A0"
679+
"myServiceLBPublicListenerC78AE8A0",
680+
"myServiceTaskDefTaskRole1C1DE6CC"
680681
]
681682
},
682683
"myServiceSecurityGroupC3B9D4E0": {
@@ -693,7 +694,8 @@
693694
"VpcId": {
694695
"Ref": "Vpc8378EB38"
695696
}
696-
}
697+
},
698+
"DependsOn": ["myServiceTaskDefTaskRole1C1DE6CC"]
697699
},
698700
"myServiceSecurityGroupfromawsecsintegcircuitbreakermyServiceLBSecurityGroupB690840480BBFF8B33": {
699701
"Type": "AWS::EC2::SecurityGroupIngress",
@@ -714,7 +716,8 @@
714716
]
715717
},
716718
"ToPort": 80
717-
}
719+
},
720+
"DependsOn": ["myServiceTaskDefTaskRole1C1DE6CC"]
718721
}
719722
},
720723
"Outputs": {

‎packages/@aws-cdk-testing/framework-integ/test/aws-ecs-patterns/test/fargate/integ.circuit-breaker-no-deployment-controller-fargate-service.js.snapshot/aws-ecs-integ-circuit-breaker-no-dc.template.json

+6-3
Original file line numberDiff line numberDiff line change
@@ -673,7 +673,8 @@
673673
},
674674
"DependsOn": [
675675
"myServiceLBPublicListenerECSGroup17E9BBC1",
676-
"myServiceLBPublicListenerC78AE8A0"
676+
"myServiceLBPublicListenerC78AE8A0",
677+
"myServiceTaskDefTaskRole1C1DE6CC"
677678
]
678679
},
679680
"myServiceSecurityGroupC3B9D4E0": {
@@ -690,7 +691,8 @@
690691
"VpcId": {
691692
"Ref": "Vpc8378EB38"
692693
}
693-
}
694+
},
695+
"DependsOn": ["myServiceTaskDefTaskRole1C1DE6CC"]
694696
},
695697
"myServiceSecurityGroupfromawsecsintegcircuitbreakernodcmyServiceLBSecurityGroupBDCB2AE380B499F76F": {
696698
"Type": "AWS::EC2::SecurityGroupIngress",
@@ -711,7 +713,8 @@
711713
]
712714
},
713715
"ToPort": 80
714-
}
716+
},
717+
"DependsOn": ["myServiceTaskDefTaskRole1C1DE6CC"]
715718
}
716719
},
717720
"Outputs": {

‎packages/@aws-cdk-testing/framework-integ/test/aws-ecs-patterns/test/fargate/integ.circuit-breaker-queue-processing-fargate-service.js.snapshot/aws-ecs-patterns-queue.template.json

+40-8
Original file line numberDiff line numberDiff line change
@@ -650,7 +650,11 @@
650650
"TaskDefinition": {
651651
"Ref": "QueueProcessingServiceQueueProcessingTaskDef4982F68B"
652652
}
653-
}
653+
},
654+
"DependsOn": [
655+
"QueueProcessingServiceQueueProcessingTaskDefTaskRoleDefaultPolicyAE808B19",
656+
"QueueProcessingServiceQueueProcessingTaskDefTaskRole782B79A6"
657+
]
654658
},
655659
"QueueProcessingServiceQueueProcessingFargateServiceSecurityGroup8FDF413D": {
656660
"Type": "AWS::EC2::SecurityGroup",
@@ -666,7 +670,11 @@
666670
"VpcId": {
667671
"Ref": "VPCB9E5F0B4"
668672
}
669-
}
673+
},
674+
"DependsOn": [
675+
"QueueProcessingServiceQueueProcessingTaskDefTaskRoleDefaultPolicyAE808B19",
676+
"QueueProcessingServiceQueueProcessingTaskDefTaskRole782B79A6"
677+
]
670678
},
671679
"QueueProcessingServiceQueueProcessingFargateServiceTaskCountTargetA9D54444": {
672680
"Type": "AWS::ApplicationAutoScaling::ScalableTarget",
@@ -709,7 +717,11 @@
709717
},
710718
"ScalableDimension": "ecs:service:DesiredCount",
711719
"ServiceNamespace": "ecs"
712-
}
720+
},
721+
"DependsOn": [
722+
"QueueProcessingServiceQueueProcessingTaskDefTaskRoleDefaultPolicyAE808B19",
723+
"QueueProcessingServiceQueueProcessingTaskDefTaskRole782B79A6"
724+
]
713725
},
714726
"QueueProcessingServiceQueueProcessingFargateServiceTaskCountTargetCpuScaling330150E9": {
715727
"Type": "AWS::ApplicationAutoScaling::ScalingPolicy",
@@ -725,7 +737,11 @@
725737
},
726738
"TargetValue": 50
727739
}
728-
}
740+
},
741+
"DependsOn": [
742+
"QueueProcessingServiceQueueProcessingTaskDefTaskRoleDefaultPolicyAE808B19",
743+
"QueueProcessingServiceQueueProcessingTaskDefTaskRole782B79A6"
744+
]
729745
},
730746
"QueueProcessingServiceQueueProcessingFargateServiceTaskCountTargetQueueMessagesVisibleScalingLowerPolicy332E2644": {
731747
"Type": "AWS::ApplicationAutoScaling::ScalingPolicy",
@@ -745,7 +761,11 @@
745761
}
746762
]
747763
}
748-
}
764+
},
765+
"DependsOn": [
766+
"QueueProcessingServiceQueueProcessingTaskDefTaskRoleDefaultPolicyAE808B19",
767+
"QueueProcessingServiceQueueProcessingTaskDefTaskRole782B79A6"
768+
]
749769
},
750770
"QueueProcessingServiceQueueProcessingFargateServiceTaskCountTargetQueueMessagesVisibleScalingLowerAlarm20C30A06": {
751771
"Type": "AWS::CloudWatch::Alarm",
@@ -774,7 +794,11 @@
774794
"Period": 300,
775795
"Statistic": "Maximum",
776796
"Threshold": 0
777-
}
797+
},
798+
"DependsOn": [
799+
"QueueProcessingServiceQueueProcessingTaskDefTaskRoleDefaultPolicyAE808B19",
800+
"QueueProcessingServiceQueueProcessingTaskDefTaskRole782B79A6"
801+
]
778802
},
779803
"QueueProcessingServiceQueueProcessingFargateServiceTaskCountTargetQueueMessagesVisibleScalingUpperPolicy84DD739A": {
780804
"Type": "AWS::ApplicationAutoScaling::ScalingPolicy",
@@ -799,7 +823,11 @@
799823
}
800824
]
801825
}
802-
}
826+
},
827+
"DependsOn": [
828+
"QueueProcessingServiceQueueProcessingTaskDefTaskRoleDefaultPolicyAE808B19",
829+
"QueueProcessingServiceQueueProcessingTaskDefTaskRole782B79A6"
830+
]
803831
},
804832
"QueueProcessingServiceQueueProcessingFargateServiceTaskCountTargetQueueMessagesVisibleScalingUpperAlarm2660BEDF": {
805833
"Type": "AWS::CloudWatch::Alarm",
@@ -828,7 +856,11 @@
828856
"Period": 300,
829857
"Statistic": "Maximum",
830858
"Threshold": 100
831-
}
859+
},
860+
"DependsOn": [
861+
"QueueProcessingServiceQueueProcessingTaskDefTaskRoleDefaultPolicyAE808B19",
862+
"QueueProcessingServiceQueueProcessingTaskDefTaskRole782B79A6"
863+
]
832864
},
833865
"EcsDefaultClusterMnL3mNNYNVPC9C1EC7A3": {
834866
"Type": "AWS::ECS::Cluster"

0 commit comments

Comments
 (0)