feat(ecs): add fargate ephemeral storage encryption to cluster settings by jaecktec · Pull Request #30759 · aws/aws-cdk

jaecktec · 2024-07-05T11:35:29Z

Issue # (if applicable)

Closes #30721

Reason for this change

Expose api on ECS L2 Cluster construct to encrypt fargate ephemeral storage

Description of changes

adds new property to pass key for encrypton.
Updates key policy according to developer documentation

Description of how you validated changes

Added unit tests to validate cases where cluster has a generated name or a specified name.

When name is random, the key policy can't be as restrictive since it will generate a cyclic dependency issue due to the Key Policy being inline in KMS

Checklist

My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

aws-cdk-automation

The pull request linter has failed. See the aws-cdk-automation comment below for failure reasons. If you believe this pull request should receive an exemption, please comment and provide a justification.

A comment requesting an exemption should contain the text Exemption Request. Additionally, if clarification is needed add Clarification Request to a comment.

✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.

lpizzinidev

Thanks 👍 Left some comments for adjustments

...aws-cdk-testing/framework-integ/test/aws-ecs/test/integ.cluster-encrypt-ephemeral-storage.ts

packages/aws-cdk-lib/aws-ecs/lib/cluster.ts

jaecktec · 2024-08-16T13:30:46Z

TBH this integration test stuff is so frustrating.. it works on my machine + account. I have no idea why it always fails in the pipeline.... the logs are not very helpful either

daschaa · 2024-08-20T11:42:23Z

@jaecktec Other snapshots have changed (I guess due to your changes). Just make sure to update those and I think you're good to go.

Below I added a snippet of some changes, there are more in the logs.

@aws-cdk-testing/framework-integ:   CHANGED    aws-stepfunctions-tasks/test/ecs/integ.fargate-task 1.141s
@aws-cdk-testing/framework-integ:       Resources
@aws-cdk-testing/framework-integ: [~] AWS::ECS::Cluster FargateCluster7CCD5F93 
@aws-cdk-testing/framework-integ:  â””â”€ [+] Configuration
@aws-cdk-testing/framework-integ:      â””â”€ {}
@aws-cdk-testing/framework-integ:   UNCHANGED  aws-stepfunctions-tasks/test/emr/integ.emr-create-cluster-add-step-runtime-role 1.112s
@aws-cdk-testing/framework-integ:   CHANGED    aws-stepfunctions-tasks/test/ecs/integ.fargate-run-task 1.219s
@aws-cdk-testing/framework-integ:       Resources
@aws-cdk-testing/framework-integ: [~] AWS::ECS::Cluster FargateCluster7CCD5F93 
@aws-cdk-testing/framework-integ:  â””â”€ [+] Configuration
@aws-cdk-testing/framework-integ:      â””â”€ {}
@aws-cdk-testing/framework-integ:   CHANGED    aws-stepfunctions-tasks/test/ecs/integ.ec2-run-task 1.426s
@aws-cdk-testing/framework-integ:       Resources
@aws-cdk-testing/framework-integ: [~] AWS::ECS::Cluster Ec2ClusterEE43E89D 
@aws-cdk-testing/framework-integ:  â””â”€ [+] Configuration
@aws-cdk-testing/framework-integ:      â””â”€ {}
@aws-cdk-testing/framework-integ:   CHANGED    aws-stepfunctions-tasks/test/ecs/integ.ec2-task 1.39s
@aws-cdk-testing/framework-integ:       Resources
@aws-cdk-testing/framework-integ: [~] AWS::ECS::Cluster FargateCluster7CCD5F93 
@aws-cdk-testing/framework-integ:  â””â”€ [+] Configuration
@aws-cdk-testing/framework-integ:      â””â”€ {}

also return undefined if neither storage nor executeCommand config are set

GavinZZ

Nice, thanks for contributing!

mergify · 2024-10-07T19:35:01Z

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

mergify · 2024-10-07T19:40:02Z

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

…ption

Pull request has been modified.

mergify · 2024-10-07T23:04:18Z

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

mergify · 2024-10-07T23:08:12Z

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

…ption

aws-cdk-automation · 2024-10-08T00:05:25Z

AWS CodeBuild CI Report

CodeBuild project: AutoBuildv2Project1C6BFA3F-wQm2hXv2jqQv
Commit ID: 2d6f003
Result: SUCCEEDED
Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

mergify · 2024-10-08T00:05:53Z

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

github-actions · 2024-10-08T00:06:09Z

Comments on closed issues and PRs are hard for our team to see.
If you need help, please open a new issue that references this one.

aws-cdk-automation requested a review from a team July 5, 2024 11:35

github-actions bot added effort/medium Medium work item – several days of effort feature-request A feature should be added or improved. p2 beginning-contributor [Pilot] contributed between 0-2 PRs to the CDK labels Jul 5, 2024

aws-cdk-automation previously requested changes Jul 5, 2024

View reviewed changes

jaecktec force-pushed the 30721-enable-fargate-ephemeral-storage-encryption branch from 09a2fa0 to 440799d Compare July 5, 2024 11:44

jaecktec changed the title ~~feat(ecs) add fargate ephemeral storage encryption to cluster settings~~ feat(ecs): add fargate ephemeral storage encryption to cluster settings Jul 5, 2024

aws-cdk-automation added the pr/reviewer-clarification-requested The contributor has requested clarification on feedback, a failing build, or a failing PR Linter run label Jul 5, 2024

github-actions bot mentioned this pull request Jul 8, 2024

Weekly PR metrics report #30783

Closed

jaecktec force-pushed the 30721-enable-fargate-ephemeral-storage-encryption branch from 36c3324 to f0e72cd Compare July 8, 2024 11:43

aws-cdk-automation removed the pr/reviewer-clarification-requested The contributor has requested clarification on feedback, a failing build, or a failing PR Linter run label Jul 8, 2024

jaecktec marked this pull request as draft July 9, 2024 06:16

jaecktec marked this pull request as ready for review July 9, 2024 06:46

aws-cdk-automation added the pr/reviewer-clarification-requested The contributor has requested clarification on feedback, a failing build, or a failing PR Linter run label Jul 11, 2024

aws-cdk-automation added pr/needs-community-review This PR needs a review from a Trusted Community Member or Core Team Member. and removed pr/reviewer-clarification-requested The contributor has requested clarification on feedback, a failing build, or a failing PR Linter run labels Jul 19, 2024

lpizzinidev suggested changes Jul 29, 2024

View reviewed changes

aws-cdk-automation removed the pr/needs-community-review This PR needs a review from a Trusted Community Member or Core Team Member. label Jul 29, 2024

github-actions bot mentioned this pull request Aug 1, 2024

Monthly PR metrics report #30999

Closed

jaecktec marked this pull request as draft August 9, 2024 13:26

jaecktec force-pushed the 30721-enable-fargate-ephemeral-storage-encryption branch 3 times, most recently from 2a1f506 to 4030fb1 Compare August 16, 2024 13:05

jaecktec force-pushed the 30721-enable-fargate-ephemeral-storage-encryption branch from 2419cdd to 43456d9 Compare August 20, 2024 13:21

jaecktec marked this pull request as ready for review August 20, 2024 13:59

jaecktec requested a review from lpizzinidev August 20, 2024 15:11

daschaa approved these changes Aug 21, 2024

View reviewed changes

aws-cdk-automation added the pr/needs-maintainer-review This PR needs a review from a Core Team Member label Aug 21, 2024

jaecktec force-pushed the 30721-enable-fargate-ephemeral-storage-encryption branch 2 times, most recently from fc2ed05 to a3d6207 Compare September 21, 2024 10:48

jaecktec requested a review from aws-cdk-automation September 23, 2024 07:18

jaecktec added 2 commits October 1, 2024 13:41

add fargate ephemeral storage encryption to cluster settings

a45bf63

update snapshots

f0389ec

also return undefined if neither storage nor executeCommand config are set

jaecktec force-pushed the 30721-enable-fargate-ephemeral-storage-encryption branch from 412c29e to f0389ec Compare October 1, 2024 11:41

GavinZZ previously approved these changes Oct 7, 2024

View reviewed changes

aws-cdk-automation removed the pr/needs-maintainer-review This PR needs a review from a Core Team Member label Oct 7, 2024

Merge branch 'main' into 30721-enable-fargate-ephemeral-storage-encry…

75b694b

…ption

aws-cdk-automation added the pr/needs-maintainer-review This PR needs a review from a Core Team Member label Oct 7, 2024

GavinZZ approved these changes Oct 7, 2024

View reviewed changes

aws-cdk-automation removed the pr/needs-maintainer-review This PR needs a review from a Core Team Member label Oct 7, 2024

Merge branch 'main' into 30721-enable-fargate-ephemeral-storage-encry…

2d6f003

…ption

mergify bot merged commit 642a944 into aws:main Oct 8, 2024

github-actions bot locked as resolved and limited conversation to collaborators Oct 8, 2024

jaecktec deleted the 30721-enable-fargate-ephemeral-storage-encryption branch October 8, 2024 07:12

Conversation

jaecktec commented Jul 5, 2024

Issue # (if applicable)

Reason for this change

Description of changes

Description of how you validated changes

Checklist

Uh oh!

aws-cdk-automation left a comment

Choose a reason for hiding this comment

Uh oh!

lpizzinidev left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

jaecktec commented Aug 16, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

daschaa commented Aug 20, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

GavinZZ left a comment

Choose a reason for hiding this comment

Uh oh!

mergify bot commented Oct 7, 2024

Uh oh!

mergify bot commented Oct 7, 2024

Uh oh!

mergify bot commented Oct 7, 2024

Uh oh!

mergify bot commented Oct 7, 2024

Uh oh!

aws-cdk-automation commented Oct 8, 2024

AWS CodeBuild CI Report

Uh oh!

mergify bot commented Oct 8, 2024

Uh oh!

github-actions bot commented Oct 8, 2024

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

jaecktec commented Aug 16, 2024 •

edited

Loading

daschaa commented Aug 20, 2024 •

edited

Loading