RunEcsEc2Task task_definition accepts TaskDefinition instead of ITaskDefinition

[mb-dev]

Describe the bug
RunEcsEc2Task task_definition accepts TaskDefinition instead of ITaskDefinition. As a result when assigning task_definition from ecs.TaskDefinition.from_task_definition_arn I get an error:

jsii.errors.JavaScriptError:
  Error: Object of type @aws-cdk/aws-ecs.ITaskDefinition is not convertible to @aws-cdk/aws-ecs.TaskDefinition
...

File "/Library/Frameworks/Python.framework/Versions/3.6/lib/python3.6/site-packages/jsii/_runtime.py", line 66, in __call__
    inst = super().__call__(*args, **kwargs)
  File "/Library/Frameworks/Python.framework/Versions/3.6/lib/python3.6/site-packages/aws_cdk/aws_stepfunctions_tasks/__init__.py", line 775, in __init__
    jsii.create(RunEcsEc2Task, self, [props])
  File "/Library/Frameworks/Python.framework/Versions/3.6/lib/python3.6/site-packages/jsii/_kernel/__init__.py", line 199, in create
    overrides=overrides,
  File "/Library/Frameworks/Python.framework/Versions/3.6/lib/python3.6/site-packages/jsii/_kernel/providers/process.py", line 331, in create
    return self._process.send(request, CreateResponse)
  File "/Library/Frameworks/Python.framework/Versions/3.6/lib/python3.6/site-packages/jsii/_kernel/providers/process.py", line 316, in send
    raise JSIIError(resp.error) from JavaScriptError(resp.stack)
jsii.errors.JSIIError: Object of type @aws-cdk/aws-ecs.ITaskDefinition is not convertible to @aws-cdk/aws-ecs.TaskDefinition

To Reproduce

task_definition = ecs.TaskDefinition.from_task_definition_arn(...)
ecs_task = sft.RunEcsEc2Task(
   task_definition=task_definition,
)

Expected behavior
Task definition will be created

Version:

• OS: Mac
• Programming Language: Python
• CDK Version: 0.35.0

[fulghum]

Let's take a look and determine the scope of this fix.

[skinny85]

So, there are 3 places where we are currently using properties in RunEcsEc2Task that are in TaskDefinition but not in ITaskDefinition:

• defaultContainer
• networkMode
• taskRole

The problem is the later 2 are required properties, which cannot be sensibly filled for an imported by ARN task definition; and the first one, even though it's optional, needs to be provided, or otherwise an exception will be thrown.

This makes it quite tricky to make a fromTaskDefinitionArn-imported object work in RunEcsEc2Task. We could perhaps add a fromTaskDefinitionAttributes method, that can allow you to pass additional info used to fill these properties, but the bad part is that we would still have to make them required in ITaskDefinition, as JSII does not allow changing the type when implementing an interface.

Another option could be to re-name them in ITaskDefinition, keeping the existing names in TaskDefinition, and make the new ones in ITaskDefinition optional - but that might be confusing (what would we re-name taskRole to, for example?)...

Thoughts on this?

[skinny85]

@mb-dev unfortunately, we concluded that there's no way to use an imported task definition in RunEcsEc2Task - it requires information that is simply not known for imported objects. Sorry about that. I'll be submitting a PR updating our documentation to make that 100% clear.

[skorfmann]

Is there any alternative, besides from falling back to a Lambda function?

[vrajpur]

How to tackle this problem? or any other method

[bun913]

We can use CustomState.

I can solve this problem like below.

import * as sfn from "aws-cdk-lib/aws-stepfunctions";

// define parameter type
type RunTaskStateParam = {
  Type: "Task";
  Resource: "arn:aws:states:::ecs:runTask.sync";
  Parameters: {
    LaunchType: "FARGATE";
    Cluster: string;
    TaskDefinition: string;
    NetworkConfiguration: {
      AwsvpcConfiguration: {
        Subnets: string[];
        SecurityGroups: string[];
      };
    };
  };
};

// Use CustomState
const step1Param: RunTaskStateParam = {
  Type: "Task",
  Resource: "arn:aws:states:::ecs:runTask.sync",
  Parameters: {
    LaunchType: "FARGATE",
    Cluster: "${ClusterArn}",
    TaskDefinition: "${TaskdefID}",
    NetworkConfiguration: {
      AwsvpcConfiguration: {
        Subnets: ["${SubnetID}"],
        SecurityGroups: ["${SecurityGroupID}"],
      },
    },
  },
};
const step1State = new sfn.CustomState(this, "RunExsitingTaskdef", {
  stateJson: step1Param,
});

ref: #24097

[tuananhhedspibkclone]

@bun913 Have you met this error not authorized to create managed-rule before ?
It's really same here https://stackoverflow.com/questions/60612853/nested-step-function-in-a-step-function-unknown-error-not-authorized-to-cr