Support Secret with partial Arn

[tuler]

When a container in a TaskDefinition uses a secret, it automatically adds to the taskDefinition generated ExecutionRole the IAM permission to read the secret value.

If the secret is imported from an existing resource, by using secretsmanager.Secret.fromSecretAttributes or secretsmanager.Secret.fromSecretArn the Arn can be an partial Arn, without the - and 6 random chars AWS appends to the friendly name.

The problem is that Secret.grantRead gives permission to the exact Arn only, so the task fails to execute.

Use Case

It's common to use partial Arn when using secrets, because they represent friendly names.

Proposed Solution

I tried to manually add a more relaxed policy to the taskDefinition execution role, but it did not work.

taskDefinition.addToExecutionRolePolicy(new iam.PolicyStatement({
  actions: ["secretsmanager:GetSecretValue"],
  resources: [secretArn + '*'],
}));

I don't know why it did not work, or if this is the best approach.

• 👋 I may be able to implement this feature request
• ⚠️ This feature might incur a breaking change

---

This is a 🚀 Feature Request

[skinny85]

Related: #7444, #6889 (comment)