fix(ecs): EC2 metadata access is blocked when using EC2 capacity provider for autoscaling

[juinquok]

Why is this needed?

When adding a auto scaling group as a capacity provider using Cluster.addAsgCapacityProvider and when the task definition being run uses the AWS_VPC network mode, it results in the metadata service at 169.254.169.254 being blocked . This is a security best practice as detailed here. This practice is implemented here. However by doing this, some applications such as those raised in #28270 as well as the aws-otel package will not be able to source for the AWS region and thus, cause the application to crash and exit.

What does it implement?

This PR add an override to the addContainer method when using the Ec2TaskDefinition to add in the AWS_REGION environment variable to the container if the network mode is set as AWS_VPC. The region is sourced by referencing to the stack which includes this construct at synth time.This environment variable is only required in the EC2 Capacity Provider mode and not in Fargate as this issue of not being able to source for the region on startup is only present when using the EC2 Capacity Provider with the AWS_VPC networking mode. The initial issue addresses this during the addAsgCapacityProvider action which targets the cluster. However, we cannot mutate the task definition at that point in time thus, this change addresses it when the task definition is actually added to a service that meets all the requirements whereby the failure to source for region will occur.

Updated the relevant integration tests to reflect the new environment variable being created alongside user-defined environment variables.

Closes #28270

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[aws-cdk-automation]

The pull request linter has failed. See the aws-cdk-automation comment below for failure reasons. If you believe this pull request should receive an exemption, please comment and provide a justification.

A comment requesting an exemption should contain the text Exemption Request. Additionally, if clarification is needed add Clarification Request to a comment.

✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.

[lpizzinidev]

Thanks 👍
I left some notes for improvements.
Also, the title should be changed to describe the bug (not the solution).
Something like fix(ecs): EC2 metadata access is blocked on auto scaling.

[lpizzinidev]

Suggested change

	if (this.networkMode === NetworkMode.AWS_VPC) {
	return new ContainerDefinition(this, id, {
	taskDefinition: this,
	...props,
	environment: {
	...props.environment,
	AWS_REGION: Stack.of(this).region,
	},
	});
	}
	// If network mode is not AWSVPC, then just add the container as normal
	return new ContainerDefinition(this, id, { taskDefinition: this, ...props });
	if (this.networkMode === NetworkMode.AWS_VPC) {
	return super.addContainer(id, {
	...props,
	environment: {
	...props.environment,
	AWS_REGION: Stack.of(this).region,
	},
	});
	}
	// If network mode is not AWSVPC, then just add the container as normal
	return super.addContainer(id, props);

Let's reuse the parent's class method

[lpizzinidev]

This case should be separated into another test.

[lpizzinidev]

Can you also add another test with awsvpc network mode and no added environment variables? (will set only AWS_REGION)

[juinquok]

Thanks 👍 I left some notes for improvements. Also, the title should be changed to describe the bug (not the solution). Something like fix(ecs): EC2 metadata access is blocked on auto scaling.

Thank You! I have updated the method and also the tests! :)

[lpizzinidev]

Thanks 👍

[paulhcsun]

Great work @juinquok!

And thanks for the review @lpizzinidev!

[mergify]

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

[mergify]

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

[aws-cdk-automation]

AWS CodeBuild CI Report

• CodeBuild project: AutoBuildv2Project1C6BFA3F-wQm2hXv2jqQv
• Commit ID: 42c815c
• Result: SUCCEEDED
• Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

[mergify]

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).