### Describe the bug According to the [document](https://docs.aws.amazon.com/codepipeline/latest/userguide/security-iam.html#how-to-custom-role), `ecs:TagResource` is required for the role but missing in our code: https://github.com/aws/aws-cdk/blob/f0383d65c7cc8017c55ec9c9262d4a863bb63730/packages/aws-cdk-lib/aws-codepipeline-actions/lib/ecs/deploy-action.ts#L84-L92 ### Expected Behavior The correct policy statement should be updated: ``` { "Effect": "Allow", "Action": [ "ecs:DescribeServices", "ecs:DescribeTaskDefinition", "ecs:DescribeTasks", "ecs:ListTasks", "ecs:RegisterTaskDefinition", "ecs:TagResource", "ecs:UpdateService" ], "Resource": "resource_ARN" }, ``` ### Current Behavior missing `ecs:TagResource` ### Reproduction Steps N/A ### Possible Solution _No response_ ### Additional Information/Context _No response_ ### CDK CLI Version v2.131.0 ### Framework Version _No response_ ### Node.js Version all versions ### OS all ### Language TypeScript ### Language Version _No response_ ### Other information _No response_
Describe the bug
According to the document,
ecs:TagResourceis required for the role but missing in our code:aws-cdk/packages/aws-cdk-lib/aws-codepipeline-actions/lib/ecs/deploy-action.ts
Lines 84 to 92 in f0383d6
Expected Behavior
The correct policy statement should be updated:
Current Behavior
missing
ecs:TagResourceReproduction Steps
N/A
Possible Solution
No response
Additional Information/Context
No response
CDK CLI Version
v2.131.0
Framework Version
No response
Node.js Version
all versions
OS
all
Language
TypeScript
Language Version
No response
Other information
No response