Export service's TaskRole in Cloudformation output for add-on importing

[gautam-nutalapati]

We create KMS key in add-ons, and would like to restrict it to service task role. Can we expose task role ARN in Cloudformation so we can use it in KMC access policy in addons?

UPDATE: Please note that unlike applying policy to task role via addons, in this case we need to use task role ARN in addons. Refer: KMS key-policies

[huanjani]

Hi, @gautam-nutalapati!

You can create a Parameters file for your addons template that refers to your Task Role ARN. See https://aws.github.io/copilot-cli/docs/developing/addons/workload/#customizing-the-parameters-section.

[huanjani]

In .../addons/addons.parameters.yml:

Parameters:
    TaskRoleArn: !GetAtt TaskRole.Arn

[gautam-nutalapati]

I tried this and got the error ValidationError: Circular dependency between resources: [TaskDefinition, AddonsStack, Service, TaskRole]

Steps:

• In /addons/addons.parameters.yml I added

  Parameters:
    TaskRoleArn: !GetAtt TaskRole.Arn
  

• In /addons/kms.yml

  Parameters:
    ECSTaskArn:
      Type: String
      Description: TaskRoleArn created by main Stack.
      .
      .
  Resources:
    DataEncryptionKey:
      Type: AWS::KMS::Key
      Properties:
        ...
        KeyPolicy:
          Version: '2012-10-17'
          Id: key-default-1
          Statement:
            - Sid: Encrypt and decrypt permission for service
              Effect: Allow
              Principal:
                AWS: !Ref ECSTaskArn
              Action:
            ...
  
  

I guess this approach may not work as TaskRole resource refers to policies created by AddOns and referring to TaskRole in turn in AddOns may be causing this issue.

I don't know if there's a way to solve this unless we create KMS key in main stack itself. For now, we will continue to hard code ARNs. :/

Let us know your thoughts.

[Lou1415926]

@gautam-nutalapati Hi hi! Have you tried moving DataEncryptionKey into the main stack via. yaml patch?

[github-actions[bot]]

This issue is stale because it has been open 60 days with no response activity. Remove the stale label, add a comment, or this will be closed in 14 days.

[github-actions[bot]]

This issue is closed due to inactivity. Feel free to reopen the issue if you have any further questions!