Closed GavinZZ closed 1 week ago
Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).
Powered by github-codebuild-logs, available on the AWS Serverless Application Repository
Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).
Comments on closed issues and PRs are hard for our team to see. If you need help, please open a new issue that references this one.
Issue # (if applicable)
Closes https://github.com/aws/aws-cdk/issues/31397
Reason for this change
If a FargateService or EC2 Service has
enableExecuteCommand: true
and the ECS cluster it runs on hasexecuteCommandConfiguration.logging
set to anything butecs.ExecuteCommandLogging.NONE
then the CDK automatically grants the underlying TaskDefinition overly broad cloudwatch logs permissions regardless of need even if the logging configuration has no cloudwatch logs config set.This is not right behaviour as these permissions are not needed.
Description of changes
Add feature flag and if feature flag is on and cloudwatch log is configured, reduce the permissions.
Description of how you validated changes
New unit tests, integration tests.
Checklist
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license