Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix: add subnets prop to GuScheduledEcsTask #1891

Merged
merged 3 commits into from
Jun 15, 2023
Merged

fix: add subnets prop to GuScheduledEcsTask #1891

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
6c34009
fix: add `subnets` prop to `GuScheduledEcsTask`
marsavar Jun 13, 2023
f055aed
fix: Default to private subnets, add tests
marsavar Jun 14, 2023
6cc26ee
Merge branch 'main' into ms-scheduled-ecs-subnet
marsavar Jun 15, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
222 changes: 221 additions & 1 deletion src/constructs/ecs/__snapshots__/ecs-task.test.ts.snap
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,107 @@
exports[`The GuEcsTask pattern should create the correct resources with lots of config 1`] = `
{
"Mappings": {
"DefaultCrNodeVersionMap": {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do we know where these new mappings originate from? Feels unrelated to the change we're making in this PR, so it's surprising to see.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not quite sure - I think I deleted the snapshot file while working on this, and rerunning the test generated these mappings. 🫠

"af-south-1": {
"value": "nodejs16.x",
},
"ap-east-1": {
"value": "nodejs16.x",
},
"ap-northeast-1": {
"value": "nodejs16.x",
},
"ap-northeast-2": {
"value": "nodejs16.x",
},
"ap-northeast-3": {
"value": "nodejs16.x",
},
"ap-south-1": {
"value": "nodejs16.x",
},
"ap-south-2": {
"value": "nodejs16.x",
},
"ap-southeast-1": {
"value": "nodejs16.x",
},
"ap-southeast-2": {
"value": "nodejs16.x",
},
"ap-southeast-3": {
"value": "nodejs16.x",
},
"ca-central-1": {
"value": "nodejs16.x",
},
"cn-north-1": {
"value": "nodejs16.x",
},
"cn-northwest-1": {
"value": "nodejs16.x",
},
"eu-central-1": {
"value": "nodejs16.x",
},
"eu-central-2": {
"value": "nodejs16.x",
},
"eu-north-1": {
"value": "nodejs16.x",
},
"eu-south-1": {
"value": "nodejs16.x",
},
"eu-south-2": {
"value": "nodejs16.x",
},
"eu-west-1": {
"value": "nodejs16.x",
},
"eu-west-2": {
"value": "nodejs16.x",
},
"eu-west-3": {
"value": "nodejs16.x",
},
"me-central-1": {
"value": "nodejs16.x",
},
"me-south-1": {
"value": "nodejs16.x",
},
"sa-east-1": {
"value": "nodejs16.x",
},
"us-east-1": {
"value": "nodejs16.x",
},
"us-east-2": {
"value": "nodejs16.x",
},
"us-gov-east-1": {
"value": "nodejs16.x",
},
"us-gov-west-1": {
"value": "nodejs16.x",
},
"us-iso-east-1": {
"value": "nodejs14.x",
},
"us-iso-west-1": {
"value": "nodejs14.x",
},
"us-isob-east-1": {
"value": "nodejs14.x",
},
"us-west-1": {
"value": "nodejs16.x",
},
"us-west-2": {
"value": "nodejs16.x",
},
},
"ServiceprincipalMap": {
"af-south-1": {
"states": "states.af-south-1.amazonaws.com",
Expand Down Expand Up @@ -109,6 +210,7 @@ exports[`The GuEcsTask pattern should create the correct resources with lots of
"gu:cdk:constructs": [
"GuStack",
"GuEcsTask",
"GuSubnetListParameter",
"GuDistributionBucketParameter",
],
"gu:cdk:version": "TEST",
Expand All @@ -121,13 +223,124 @@ exports[`The GuEcsTask pattern should create the correct resources with lots of
},
},
"Parameters": {
"AssetParameters28739348edff6f1084f6a50d8d934e2d3fc2a3bb77442d8a9a1361d51ccd03c0ArtifactHashAF1370F8": {
"Description": "Artifact hash for asset "28739348edff6f1084f6a50d8d934e2d3fc2a3bb77442d8a9a1361d51ccd03c0"",
"Type": "String",
},
"AssetParameters28739348edff6f1084f6a50d8d934e2d3fc2a3bb77442d8a9a1361d51ccd03c0S3BucketCD1790E7": {
"Description": "S3 bucket for asset "28739348edff6f1084f6a50d8d934e2d3fc2a3bb77442d8a9a1361d51ccd03c0"",
"Type": "String",
},
"AssetParameters28739348edff6f1084f6a50d8d934e2d3fc2a3bb77442d8a9a1361d51ccd03c0S3VersionKeyCE63AE8F": {
"Description": "S3 key for asset version "28739348edff6f1084f6a50d8d934e2d3fc2a3bb77442d8a9a1361d51ccd03c0"",
"Type": "String",
},
"DistributionBucketName": {
"Default": "/account/services/artifact.bucket",
"Description": "SSM parameter containing the S3 bucket name holding distribution artifacts",
"Type": "AWS::SSM::Parameter::Value<String>",
},
"ecstestPrivateSubnets": {
"Default": "/account/vpc/primary/subnets/private",
"Description": "A list of private subnets",
"Type": "AWS::SSM::Parameter::Value<List<AWS::EC2::Subnet::Id>>",
},
},
"Resources": {
"AWSCDKCfnUtilsProviderCustomResourceProviderHandlerCF82AA57": {
"DependsOn": [
"AWSCDKCfnUtilsProviderCustomResourceProviderRoleFE0EE867",
],
"Properties": {
"Code": {
"S3Bucket": {
"Ref": "AssetParameters28739348edff6f1084f6a50d8d934e2d3fc2a3bb77442d8a9a1361d51ccd03c0S3BucketCD1790E7",
},
"S3Key": {
"Fn::Join": [
"",
[
{
"Fn::Select": [
0,
{
"Fn::Split": [
"||",
{
"Ref": "AssetParameters28739348edff6f1084f6a50d8d934e2d3fc2a3bb77442d8a9a1361d51ccd03c0S3VersionKeyCE63AE8F",
},
],
},
],
},
{
"Fn::Select": [
1,
{
"Fn::Split": [
"||",
{
"Ref": "AssetParameters28739348edff6f1084f6a50d8d934e2d3fc2a3bb77442d8a9a1361d51ccd03c0S3VersionKeyCE63AE8F",
},
],
},
],
},
],
],
},
},
"Handler": "__entrypoint__.handler",
"MemorySize": 128,
"Role": {
"Fn::GetAtt": [
"AWSCDKCfnUtilsProviderCustomResourceProviderRoleFE0EE867",
"Arn",
],
},
"Runtime": "nodejs16.x",
"Timeout": 900,
},
"Type": "AWS::Lambda::Function",
},
"AWSCDKCfnUtilsProviderCustomResourceProviderRoleFE0EE867": {
"Properties": {
"AssumeRolePolicyDocument": {
"Statement": [
{
"Action": "sts:AssumeRole",
"Effect": "Allow",
"Principal": {
"Service": "lambda.amazonaws.com",
},
},
],
"Version": "2012-10-17",
},
"ManagedPolicyArns": [
{
"Fn::Sub": "arn:\${AWS::Partition}:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole",
},
],
},
"Type": "AWS::IAM::Role",
},
"CdkJsonStringify2": {
"DeletionPolicy": "Delete",
"Properties": {
"ServiceToken": {
"Fn::GetAtt": [
"AWSCDKCfnUtilsProviderCustomResourceProviderHandlerCF82AA57",
"Arn",
],
},
"Value": {
"Ref": "ecstestPrivateSubnets",
},
},
"Type": "Custom::AWSCDKCfnJsonStringify",
"UpdateReplacePolicy": "Delete",
},
"ecstestexecutionfailedC93F511B": {
"Properties": {
"ActionsEnabled": true,
Expand Down Expand Up @@ -243,7 +456,14 @@ exports[`The GuEcsTask pattern should create the correct resources with lots of
"Arn",
],
},
"","TaskDefinition":"test-stack-TEST-ecs-test","NetworkConfiguration":{"AwsvpcConfiguration":{"Subnets":["abc-123"],"SecurityGroups":["id-123"]}},"Overrides":{"ContainerOverrides":[{"Name":"test-ecs-task-ecs-test-TaskContainer"}]},"LaunchType":"FARGATE","PlatformVersion":"LATEST"}}}}",
"","TaskDefinition":"test-stack-TEST-ecs-test","NetworkConfiguration":{"AwsvpcConfiguration":{"Subnets":",
{
"Fn::GetAtt": [
"CdkJsonStringify2",
"Value",
],
},
","SecurityGroups":["id-123"]}},"Overrides":{"ContainerOverrides":[{"Name":"test-ecs-task-ecs-test-TaskContainer"}]},"LaunchType":"FARGATE","PlatformVersion":"LATEST"}}}}",
],
],
},
Expand Down
35 changes: 33 additions & 2 deletions src/constructs/ecs/ecs-task.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,9 +1,10 @@
import { Template } from "aws-cdk-lib/assertions";
import type { IVpc } from "aws-cdk-lib/aws-ec2";
import type { ISubnet, IVpc } from "aws-cdk-lib/aws-ec2";
import { SecurityGroup, Vpc } from "aws-cdk-lib/aws-ec2";
import { Effect, PolicyStatement } from "aws-cdk-lib/aws-iam";
import { GuTemplate, simpleGuStackForTesting } from "../../utils/test";
import type { GuStack } from "../core";
import { GuVpc, SubnetType } from "../ec2/vpc";
import { GuEcsTask } from "./ecs-task";

const makeVpc = (stack: GuStack) =>
Expand Down Expand Up @@ -38,10 +39,11 @@ describe("The GuEcsTask pattern", () => {
});
});

const generateComplexStack = (stack: GuStack, app: string, vpc: IVpc) => {
const generateComplexStack = (stack: GuStack, app: string, vpc: IVpc, subnets?: ISubnet[]) => {
new GuEcsTask(stack, `test-ecs-task-${app}`, {
containerConfiguration: { id: "node:10", type: "registry" },
vpc,
subnets,
app: app,
taskTimeoutInMinutes: 60,
cpu: 1024,
Expand Down Expand Up @@ -75,4 +77,33 @@ describe("The GuEcsTask pattern", () => {
template.hasGuTaggedResource("AWS::ECS::TaskDefinition", { appIdentity: { app: "ecs-test" } });
template.hasGuTaggedResource("AWS::ECS::TaskDefinition", { appIdentity: { app: "ecs-test2" } });
});

it("should default to private subnets when no subnet prop is specified", () => {
const stack = simpleGuStackForTesting();

generateComplexStack(stack, "ecs-private-subnet-test", makeVpc(stack));

const template = Template.fromStack(stack);

template.hasParameter("ecsprivatesubnettestPrivateSubnets", {
Default: "/account/vpc/primary/subnets/private",
});
});

it("should override private subnets when the `subnets` prop is specified", () => {
const stack = simpleGuStackForTesting();
const app = "ecs-public-subnet-test";

generateComplexStack(
stack,
app,
makeVpc(stack),
GuVpc.subnetsFromParameter(stack, { type: SubnetType.PUBLIC, app })
);

const template = Template.fromStack(stack);
template.hasParameter("ecspublicsubnettestPublicSubnets", {
Default: "/account/vpc/primary/subnets/public",
});
});
});
8 changes: 7 additions & 1 deletion src/constructs/ecs/ecs-task.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
import { CfnOutput, Duration } from "aws-cdk-lib";
import { Alarm, TreatMissingData } from "aws-cdk-lib/aws-cloudwatch";
import { SnsAction } from "aws-cdk-lib/aws-cloudwatch-actions";
import type { ISecurityGroup, IVpc } from "aws-cdk-lib/aws-ec2";
import type { ISecurityGroup, ISubnet, IVpc } from "aws-cdk-lib/aws-ec2";
import type { IRepository } from "aws-cdk-lib/aws-ecr";
import {
Cluster,
Expand All @@ -20,6 +20,7 @@ import { Construct } from "constructs";
import type { NoMonitoring } from "../cloudwatch";
import type { GuStack } from "../core";
import { AppIdentity } from "../core";
import { GuVpc, SubnetType } from "../ec2";
import { GuGetDistributablePolicyStatement } from "../iam";

/**
Expand Down Expand Up @@ -112,6 +113,7 @@ export interface GuEcsTaskProps extends AppIdentity {
customTaskPolicies?: PolicyStatement[];
environmentOverrides?: TaskEnvironmentVariable[];
storage?: number;
subnets?: ISubnet[];
}

/**
Expand All @@ -135,6 +137,8 @@ const getContainer = (config: ContainerConfiguration) => {
*
* Note that if your task reliably completes in less than 15 minutes then you should probably use a [[`GuLambda`]] instead. This
* pattern was mainly created to work around the 15 minute lambda timeout.
*
* If the `subnets` prop is not defined, the task will run in a private subnet by default.
*/
export class GuEcsTask extends Construct {
stateMachine: StateMachine;
Expand All @@ -154,6 +158,7 @@ export class GuEcsTask extends Construct {
taskTimeoutInMinutes = 15,
customTaskPolicies,
vpc,
subnets = GuVpc.subnetsFromParameter(scope, { type: SubnetType.PRIVATE, app }),
monitoringConfiguration,
securityGroups = [],
environmentOverrides,
Expand Down Expand Up @@ -200,6 +205,7 @@ export class GuEcsTask extends Construct {

const task = new EcsRunTask(scope, `${id}-task`, {
cluster,
subnets: { subnets },
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think we can be more opinionated here, and always place the task in the private subnet (similar to how we implement EC2 apps). WDYT?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I thought about it but wondered whether there were any use cases where a consumer would want the task in the public subnet. Couldn't really come up with any.
I think your suggestion makes a lot of sense, especially since we have a precedent in the way we do EC2 apps. Will default to private subnets then, and document it.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Were you imagining something like this?

const privateSubnets = GuVpc.subnetsFromParameter(scope, { type: SubnetType.PRIVATE, app });

const task = new EcsRunTask(scope, `${id}-task`, {
    cluster,
    subnets: { subnets: privateSubnets },
    ...
}

This would effectively make the subnets prop redundant, since we're defining the subnets in the pattern constructor.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That would work. If you wanted to keep the subnets prop1, would recommend providing the destructuring with default values pattern (see taskTimeoutInMinutes above, as an example).

Footnotes

  1. Would recommend documenting the existence of this prop ↩

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

All done, thanks. Have also added a couple of tests.
Let me know if I need to do anything else before I merge! :-)

launchTarget: new EcsFargateLaunchTarget({
platformVersion: FargatePlatformVersion.LATEST,
}),
Expand Down
2 changes: 2 additions & 0 deletions src/patterns/scheduled-ecs-task.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,6 +27,8 @@ export interface GuScheduledEcsTaskProps extends GuEcsTaskProps {
*
* Note that if your task reliably completes in less than 15 minutes then you should probably use a [[`GuScheduledLambda`]] instead. This
* pattern was mainly created to work around the 15 minute lambda timeout.
*
* If the `subnets` prop is not defined, the task will run in a private subnet by default.
*/
export class GuScheduledEcsTask extends GuAppAwareConstruct(GuEcsTask) {
constructor(scope: GuStack, id: string, props: GuScheduledEcsTaskProps) {
Expand Down