aws · mergify · Jul 12, 2023 · Jul 7, 2023 · Jul 7, 2023 · Jul 7, 2023
diff --git a/packages/@aws-cdk/aws-batch-alpha/lib/ecs-container-definition.ts b/packages/@aws-cdk/aws-batch-alpha/lib/ecs-container-definition.ts
@@ -965,9 +965,17 @@ export class EcsFargateContainerDefinition extends EcsContainerDefinitionBase im
 }
 
 function createExecutionRole(scope: Construct, id: string): iam.IRole {
-  return new iam.Role(scope, id, {
+  const execRole = new iam.Role(scope, id, {
     assumedBy: new iam.ServicePrincipal('ecs-tasks.amazonaws.com'),
     // needed for cross-account access with TagParameterContainerImage
     roleName: PhysicalName.GENERATE_IF_NEEDED,
   });
+
+  // all jobs will fail without this if they produce any output at all when no logging is specified
+  execRole.addToPrincipalPolicy(new iam.PolicyStatement({
+    actions: ['logs:CreateLogStream'],
+    resources: ['*'],
+  }));
+
+  return execRole;
 }
diff --git a/packages/@aws-cdk/aws-batch-alpha/test/ecs-container-definition.test.ts b/packages/@aws-cdk/aws-batch-alpha/test/ecs-container-definition.test.ts
@@ -1,4 +1,3 @@
-
 import { Template } from 'aws-cdk-lib/assertions';
 import * as path from 'path';
 import { Vpc } from 'aws-cdk-lib/aws-ec2';
@@ -46,7 +45,15 @@ describe.each([EcsEc2ContainerDefinition, EcsFargateContainerDefinition])('%p',
   // GIVEN
   beforeEach(() => {
     stack = new Stack();
-    pascalCaseExpectedProps = capitalizePropertyNames(stack, defaultExpectedProps);
+    pascalCaseExpectedProps = capitalizePropertyNames(stack, {
+      ...defaultExpectedProps,
+      containerProperties: {
+        ...defaultExpectedProps.containerProperties,
+        executionRoleArn: {
+          'Fn::GetAtt': ['EcsContainerExecutionRole3B199293', 'Arn'],
+        } as any,
+      },
+    });
   });
 
   test('ecs container defaults', () => {
@@ -60,6 +67,42 @@ describe.each([EcsEc2ContainerDefinition, EcsFargateContainerDefinition])('%p',
     // THEN
     Template.fromStack(stack).hasResourceProperties('AWS::Batch::JobDefinition', {
       ...pascalCaseExpectedProps,
+      ContainerProperties: {
+        ExecutionRoleArn: {
+          'Fn::GetAtt': ['EcsContainerExecutionRole3B199293', 'Arn'],
+        },
+        ...pascalCaseExpectedProps.ContainerProperties,
+      },
+    });
+
+    Template.fromStack(stack).hasResourceProperties('AWS::IAM::Role', {
+      AssumeRolePolicyDocument: {
+        Statement: [
+          {
+            Action: 'sts:AssumeRole',
+            Effect: 'Allow',
+            Principal: { Service: 'ecs-tasks.amazonaws.com' },
+          },
+        ],
+        Version: '2012-10-17',
+      },
+    });
+
+    Template.fromStack(stack).hasResourceProperties('AWS::IAM::Policy', {
+      PolicyDocument: {
+        Statement: [
+          {
+            Action: 'logs:CreateLogStream',
+            Effect: 'Allow',
+            Resource: '*',
+          },
+        ],
+        Version: '2012-10-17',
+      },
+      PolicyName: 'EcsContainerExecutionRoleDefaultPolicy6F59CD37',
+      Roles: [{
+        Ref: 'EcsContainerExecutionRole3B199293',
+      }],
     });
   });
 
@@ -185,7 +228,7 @@ describe.each([EcsEc2ContainerDefinition, EcsFargateContainerDefinition])('%p',
     });
   });
 
-  test('respects logging and creates an execution role for EC2 and Fargate containers', () => {
+  test('respects logging', () => {
     // WHEN
     new EcsJobDefinition(stack, 'ECSJobDefn', {
       container: new ContainerDefinition(stack, 'EcsContainer', {
@@ -221,11 +264,13 @@ describe.each([EcsEc2ContainerDefinition, EcsFargateContainerDefinition])('%p',
 
     Template.fromStack(stack).hasResourceProperties('AWS::IAM::Role', {
       AssumeRolePolicyDocument: {
-        Statement: [{
-          Action: 'sts:AssumeRole',
-          Effect: 'Allow',
-          Principal: { Service: 'ecs-tasks.amazonaws.com' },
-        }],
+        Statement: [
+          {
+            Action: 'sts:AssumeRole',
+            Effect: 'Allow',
+            Principal: { Service: 'ecs-tasks.amazonaws.com' },
+          },
+        ],
         Version: '2012-10-17',
       },
     });
@@ -564,7 +609,15 @@ describe('EC2 containers', () => {
   // GIVEN
   beforeEach(() => {
     stack = new Stack();
-    pascalCaseExpectedProps = capitalizePropertyNames(stack, defaultExpectedProps);
+    pascalCaseExpectedProps = capitalizePropertyNames(stack, {
+      ...defaultExpectedProps,
+      containerProperties: {
+        ...defaultExpectedProps.containerProperties,
+        executionRoleArn: {
+          'Fn::GetAtt': ['EcsEc2ContainerExecutionRole90E18680', 'Arn'],
+        } as any,
+      },
+    });
   });
 
   test('respects addUlimit()', () => {
@@ -708,7 +761,15 @@ describe('Fargate containers', () => {
   // GIVEN
   beforeEach(() => {
     stack = new Stack();
-    pascalCaseExpectedProps = capitalizePropertyNames(stack, defaultExpectedProps);
+    pascalCaseExpectedProps = capitalizePropertyNames(stack, {
+      ...defaultExpectedProps,
+      containerProperties: {
+        ...defaultExpectedProps.containerProperties,
+        executionRoleArn: {
+          'Fn::GetAtt': ['EcsContainerExecutionRole3B199293', 'Arn'],
+        } as any,
+      },
+    });
   });
 
   test('create executionRole by default', () => {

diff --git a/...ch-unique-name.js.snapshot/BatchUniqueNameTestDefaultTestDeployAssertA3886AB9.assets.json b/...ch-unique-name.js.snapshot/BatchUniqueNameTestDefaultTestDeployAssertA3886AB9.assets.json
@@ -1,5 +1,5 @@
 {
-  "version": "31.0.0",
+  "version": "32.0.0",
   "files": {
     "21fbb51d7b23f6a6c262b46a9caee79d744a3ac019fd45422d988b96d44b2a22": {
       "source": {

diff --git a/packages/@aws-cdk/aws-batch-alpha/test/integ.batch-unique-name.js.snapshot/cdk.out b/packages/@aws-cdk/aws-batch-alpha/test/integ.batch-unique-name.js.snapshot/cdk.out
@@ -1 +1 @@
-{"version":"31.0.0"}
+{"version":"32.0.0"}
diff --git a/packages/@aws-cdk/aws-batch-alpha/test/integ.batch-unique-name.js.snapshot/integ.json b/packages/@aws-cdk/aws-batch-alpha/test/integ.batch-unique-name.js.snapshot/integ.json
@@ -1,5 +1,5 @@
 {
-  "version": "31.0.0",
+  "version": "32.0.0",
   "testCases": {
     "BatchUniqueNameTest/DefaultTest": {
       "stacks": [

diff --git a/packages/@aws-cdk/aws-batch-alpha/test/integ.batch-unique-name.js.snapshot/manifest.json b/packages/@aws-cdk/aws-batch-alpha/test/integ.batch-unique-name.js.snapshot/manifest.json
@@ -1,5 +1,5 @@
 {
-  "version": "31.0.0",
+  "version": "32.0.0",
   "artifacts": {
     "stack.assets": {
       "type": "cdk:asset-manifest",
@@ -17,7 +17,7 @@
         "validateOnSynth": false,
         "assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-deploy-role-${AWS::AccountId}-${AWS::Region}",
         "cloudFormationExecutionRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-cfn-exec-role-${AWS::AccountId}-${AWS::Region}",
-        "stackTemplateAssetObjectUrl": "s3://cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}/b7ced7357affd7e042169b0e624c985927080c1c2782ecab4a60b7b323cf14c4.json",
+        "stackTemplateAssetObjectUrl": "s3://cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}/6995936ee2c10a53fc4cea9df39f1837c691389b9e78db016b2490704ab86f29.json",
         "requiresBootstrapStackVersion": 6,
         "bootstrapStackVersionSsmParameter": "/cdk-bootstrap/hnb659fds/version",
         "additionalDependencies": [
@@ -57,6 +57,12 @@
             "data": "containerExecutionRoleFD602179"
           }
         ],
+        "/stack/container/ExecutionRole/DefaultPolicy/Resource": [
+          {
+            "type": "aws:cdk:logicalId",
+            "data": "containerExecutionRoleDefaultPolicyF00DA4D6"
+          }
+        ],
         "/stack/MyJob/Resource": [
           {
             "type": "aws:cdk:logicalId",
@@ -92,15 +98,6 @@
             "type": "aws:cdk:logicalId",
             "data": "CheckBootstrapVersion"
           }
-        ],
-        "MyQueue4F9177CF": [
-          {
-            "type": "aws:cdk:logicalId",
-            "data": "MyQueue4F9177CF",
-            "trace": [
-              "!!DESTRUCTIVE_CHANGES: WILL_DESTROY"
-            ]
-          }
         ]
       },
       "displayName": "stack"

diff --git a/packages/@aws-cdk/aws-batch-alpha/test/integ.batch-unique-name.js.snapshot/stack.assets.json b/packages/@aws-cdk/aws-batch-alpha/test/integ.batch-unique-name.js.snapshot/stack.assets.json
@@ -1,15 +1,15 @@
 {
-  "version": "31.0.0",
+  "version": "32.0.0",
   "files": {
-    "b7ced7357affd7e042169b0e624c985927080c1c2782ecab4a60b7b323cf14c4": {
+    "6995936ee2c10a53fc4cea9df39f1837c691389b9e78db016b2490704ab86f29": {
       "source": {
         "path": "stack.template.json",
         "packaging": "file"
       },
       "destinations": {
         "current_account-current_region": {
           "bucketName": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}",
-          "objectKey": "b7ced7357affd7e042169b0e624c985927080c1c2782ecab4a60b7b323cf14c4.json",
+          "objectKey": "6995936ee2c10a53fc4cea9df39f1837c691389b9e78db016b2490704ab86f29.json",
           "assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-file-publishing-role-${AWS::AccountId}-${AWS::Region}"
         }
       }

diff --git a/...ges/@aws-cdk/aws-batch-alpha/test/integ.batch-unique-name.js.snapshot/stack.template.json b/...ges/@aws-cdk/aws-batch-alpha/test/integ.batch-unique-name.js.snapshot/stack.template.json
@@ -79,6 +79,27 @@
     }
    }
   },
+  "containerExecutionRoleDefaultPolicyF00DA4D6": {
+   "Type": "AWS::IAM::Policy",
+   "Properties": {
+    "PolicyDocument": {
+     "Statement": [
+      {
+       "Action": "logs:CreateLogStream",
+       "Effect": "Allow",
+       "Resource": "*"
+      }
+     ],
+     "Version": "2012-10-17"
+    },
+    "PolicyName": "containerExecutionRoleDefaultPolicyF00DA4D6",
+    "Roles": [
+     {
+      "Ref": "containerExecutionRoleFD602179"
+     }
+    ]
+   }
+  },
   "MyJob8719E923": {
    "Type": "AWS::Batch::JobDefinition",
    "Properties": {

diff --git a/packages/@aws-cdk/aws-batch-alpha/test/integ.batch-unique-name.js.snapshot/tree.json b/packages/@aws-cdk/aws-batch-alpha/test/integ.batch-unique-name.js.snapshot/tree.json
@@ -172,6 +172,45 @@
                       "fqn": "aws-cdk-lib.aws_iam.CfnRole",
                       "version": "0.0.0"
                     }
+                  },
+                  "DefaultPolicy": {
+                    "id": "DefaultPolicy",
+                    "path": "stack/container/ExecutionRole/DefaultPolicy",
+                    "children": {
+                      "Resource": {
+                        "id": "Resource",
+                        "path": "stack/container/ExecutionRole/DefaultPolicy/Resource",
+                        "attributes": {
+                          "aws:cdk:cloudformation:type": "AWS::IAM::Policy",
+                          "aws:cdk:cloudformation:props": {
+                            "policyDocument": {
+                              "Statement": [
+                                {
+                                  "Action": "logs:CreateLogStream",
+                                  "Effect": "Allow",
+                                  "Resource": "*"
+                                }
+                              ],
+                              "Version": "2012-10-17"
+                            },
+                            "policyName": "containerExecutionRoleDefaultPolicyF00DA4D6",
+                            "roles": [
+                              {
+                                "Ref": "containerExecutionRoleFD602179"
+                              }
+                            ]
+                          }
+                        },
+                        "constructInfo": {
+                          "fqn": "aws-cdk-lib.aws_iam.CfnPolicy",
+                          "version": "0.0.0"
+                        }
+                      }
+                    },
+                    "constructInfo": {
+                      "fqn": "aws-cdk-lib.aws_iam.Policy",
+                      "version": "0.0.0"
+                    }
                   }
                 },
                 "constructInfo": {
@@ -410,7 +449,7 @@
                 "path": "BatchUniqueNameTest/DefaultTest/Default",
                 "constructInfo": {
                   "fqn": "constructs.Construct",
-                  "version": "10.1.270"
+                  "version": "10.2.55"
                 }
               },
               "DeployAssert": {
@@ -456,7 +495,7 @@
         "path": "Tree",
         "constructInfo": {
           "fqn": "constructs.Construct",
-          "version": "10.1.270"
+          "version": "10.2.55"
         }
       }
     },

diff --git a/packages/@aws-cdk/aws-batch-alpha/test/integ.ecs-job-definition.js.snapshot/manifest.json b/packages/@aws-cdk/aws-batch-alpha/test/integ.ecs-job-definition.js.snapshot/manifest.json
@@ -17,7 +17,7 @@
         "validateOnSynth": false,
         "assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-deploy-role-${AWS::AccountId}-${AWS::Region}",
         "cloudFormationExecutionRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-cfn-exec-role-${AWS::AccountId}-${AWS::Region}",
-        "stackTemplateAssetObjectUrl": "s3://cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}/dbfcc646c8225dd32d69798b87a8a94086dd89a2b3137bdf4e0ec96d79cdd4cb.json",
+        "stackTemplateAssetObjectUrl": "s3://cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}/dcf6cca1988526b8b989a59e051638b69aec07649e92b405ed666c3c9cb490ae.json",
         "requiresBootstrapStackVersion": 6,
         "bootstrapStackVersionSsmParameter": "/cdk-bootstrap/hnb659fds/version",
         "additionalDependencies": [
@@ -207,6 +207,12 @@
             "data": "myContainerExecutionRoleEBACF86C"
           }
         ],
+        "/stack/myContainer/ExecutionRole/DefaultPolicy/Resource": [
+          {
+            "type": "aws:cdk:logicalId",
+            "data": "myContainerExecutionRoleDefaultPolicy42DA929E"
+          }
+        ],
         "/stack/ECSJobDefn/Resource": [
           {
             "type": "aws:cdk:logicalId",
@@ -219,6 +225,12 @@
             "data": "myFargateContainerExecutionRoleB9EB79EA"
           }
         ],
+        "/stack/myFargateContainer/ExecutionRole/DefaultPolicy/Resource": [
+          {
+            "type": "aws:cdk:logicalId",
+            "data": "myFargateContainerExecutionRoleDefaultPolicy4FF431BF"
+          }
+        ],
         "/stack/ECSFargateJobDefn/Resource": [
           {
             "type": "aws:cdk:logicalId",

diff --git a/...ages/@aws-cdk/aws-batch-alpha/test/integ.ecs-job-definition.js.snapshot/stack.assets.json b/...ages/@aws-cdk/aws-batch-alpha/test/integ.ecs-job-definition.js.snapshot/stack.assets.json
@@ -1,15 +1,15 @@
 {
   "version": "32.0.0",
   "files": {
-    "dbfcc646c8225dd32d69798b87a8a94086dd89a2b3137bdf4e0ec96d79cdd4cb": {
+    "dcf6cca1988526b8b989a59e051638b69aec07649e92b405ed666c3c9cb490ae": {
       "source": {
         "path": "stack.template.json",
         "packaging": "file"
       },
       "destinations": {
         "current_account-current_region": {
           "bucketName": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}",
-          "objectKey": "dbfcc646c8225dd32d69798b87a8a94086dd89a2b3137bdf4e0ec96d79cdd4cb.json",
+          "objectKey": "dcf6cca1988526b8b989a59e051638b69aec07649e92b405ed666c3c9cb490ae.json",
           "assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-file-publishing-role-${AWS::AccountId}-${AWS::Region}"
         }
       }