feat(apprunner): make Service implement IGrantable

packages/@aws-cdk/aws-apprunner-alpha/lib/service.ts

@@ -1140,6 +1140,17 @@ export class Service extends cdk.Resource {
  this.secrets.push({ name: name, value: secret.arn });
  }
 
+ /**
+ * This method exposes the Instance Role after creating it if not set.
+ * @returns iam.IRole
+ */
+ public obtainInstanceRole(): iam.IRole {
+ if (!this.instanceRole) {
+ this.instanceRole = this.createInstanceRole();
+ }
+ return this.instanceRole;
+ }
+
  /**
  * This method generates an Instance Role. Needed if using secrets and props.instanceRole is undefined
  * @returns iam.IRole

packages/@aws-cdk/aws-apprunner-alpha/test/service.test.ts

@@ -1252,4 +1252,23 @@ testDeprecated('Using both environmentVariables and environment should throw an
  }),
  });
  }).toThrow(/You cannot set both \'environmentVariables\' and \'environment\' properties./);
-});
+});
+
+test('Service exposes instanceRole via obtainInstanceRole()', () => {
+ // GIVEN
+ const app = new cdk.App();
+ const stack = new cdk.Stack(app, 'demo-stack');
+ // WHEN
+ const service = new apprunner.Service(stack, 'DemoService', {
+ source: apprunner.Source.fromEcrPublic({
+ imageIdentifier: 'public.ecr.aws/aws-containers/hello-app-runner:latest',
+ }),
+ instanceRole: new iam.Role(stack, 'InstanceRole', {
+ assumedBy: new iam.ServicePrincipal('tasks.apprunner.amazonaws.com'),
+ }),
+ });
+ // THEN
+ expect(stack.resolve(service.obtainInstanceRole().roleArn)).toEqual({
+ 'Fn::GetAtt': ['InstanceRole3CCE2F1D', 'Arn'],
+ });
+});