Describe the bug

When using the EcsTask EventBridge target and providing tags, the auto-generated role does not get the ecs:TagResource IAM permission.

This causes problems when the AWS account has the tagResourceAuthorization setting enabled. According to an email I recently received from Amazon, this setting will be enabled by default on 29 March 2024:

March 29, 2024 - Tagging Authorization will be turned on for all AWS accounts. The account level setting will no longer be
used and will be removed from the ECS Account Settings page in the AWS Console.

Once the setting is enabled by default on all accounts, these event targets will start failing.

Expected Behavior

When I provide a list of tags on the EcsTask event target, it should automatically grant the ecs:TagResource permission for the specified tags.

Current Behavior

The role does not get the ecs:TagResource permission, which causes the event invocation to fail.

The event fails with:

User: arn:aws:sts::ACCOUNT:assumed-role/TravelBlogDeploymentPipel-StaticWordpressEcsTaskTas-MSjLKMJsnohL/b07e937039c03003adf70077b02829a0 is not authorized to perform: ecs:TagResource on resource: arn:aws:ecs:us-west-2:ACCOUNT:task/CLUSTER/* because no identity-based policy allows the ecs:TagResource action

Reproduction Steps

Consider a basic event rule, as specified in the CDK documentation:

import * as ecs from 'aws-cdk-lib/aws-ecs';

declare const cluster: ecs.ICluster;
declare const taskDefinition: ecs.TaskDefinition;

const rule = new events.Rule(this, 'Rule', {
  schedule: events.Schedule.rate(cdk.Duration.hours(1)),
});

rule.addTarget(
  new targets.EcsTask({
    cluster: cluster,
    taskDefinition: taskDefinition,
    propagateTags: ecs.PropagatedTagSource.TASK_DEFINITION,
    tags: [
      {
        key: 'my-tag',
        value: 'my-tag-value',
      },
    ],
  }),
);

This code produces an IAM role that does not allow ecs:TagResource, as you can see in the source code:

The event triggers without errors when tagResourceAuthorization is disabled. However, when you enable tagResourceAuthorization via:

aws ecs put-account-setting-default --name tagResourceAuthorization --value on

The task will start to fail because of the missing permission.

Possible Solution

The createEventRolePolicyStatements method should be updated. If tags are present the IAM policy should include ecs:TagResource for the specified tags. The docs should be reviewed and the appropriate restrictive conditions should be applied.

Additional Information/Context

No response

CDK CLI Version

2.123.0

Framework Version

No response

Node.js Version

20.11.0

OS

MacOS

Language

TypeScript

Language Version

No response

Other information

I'm unsure if this is needed if propagateTags is specified. More digging in the docs on tagResourceAuthorization is needed.