@@ -361,8 +361,7 @@ export class EcsRunTask extends sfn.TaskStateBase implements ec2.IConnectable {
361
361
throw new ValidationError ( 'Task Token is required in at least one `containerOverrides.environment` for callback. Use JsonPath.taskToken to set the token.' , this ) ;
362
362
}
363
363
364
- if ( ( this . props . taskDefinition !== undefined && this . props . taskDefinitionInput !== undefined ) ||
365
- ( this . props . taskDefinition === undefined && this . props . taskDefinitionInput === undefined ) ) {
364
+ if ( ! this . hasProvidedOneOfTaskDefinitionOrTaskDefinitionInput ( ) ) {
366
365
throw new ValidationError ( 'Exactly one of \'taskDefinition\' or \'taskDefinitionInput\' must be provided.' , this ) ;
367
366
}
368
367
@@ -408,7 +407,7 @@ export class EcsRunTask extends sfn.TaskStateBase implements ec2.IConnectable {
408
407
}
409
408
}
410
409
411
- this . taskPolicies = this . makePolicyStatements ( ) ;
410
+ this . taskPolicies = this . makePolicyStatements ( props . taskDefinition , props . taskDefinitionInput ) ;
412
411
}
413
412
414
413
/**
@@ -439,6 +438,12 @@ export class EcsRunTask extends sfn.TaskStateBase implements ec2.IConnectable {
439
438
} ;
440
439
}
441
440
441
+ private hasProvidedOneOfTaskDefinitionOrTaskDefinitionInput ( ) : boolean {
442
+ const hasOnlyProvidedTaskDefinition = this . props . taskDefinition !== undefined && this . props . taskDefinitionInput === undefined ;
443
+ const hasOnlyProvidedTaskDefinitionInput = this . props . taskDefinition === undefined && this . props . taskDefinitionInput !== undefined ;
444
+ return hasOnlyProvidedTaskDefinition || hasOnlyProvidedTaskDefinitionInput ;
445
+ }
446
+
442
447
private configureAwsVpcNetworking ( ) {
443
448
const subnetSelection = this . props . subnets ??
444
449
{ subnetType : this . props . assignPublicIp ? ec2 . SubnetType . PUBLIC : ec2 . SubnetType . PRIVATE_WITH_EGRESS } ;
@@ -469,19 +474,20 @@ export class EcsRunTask extends sfn.TaskStateBase implements ec2.IConnectable {
469
474
}
470
475
}
471
476
472
- private makeEcsPolicyStatements ( ) : iam . PolicyStatement [ ] {
477
+ private makeEcsPolicyStatements ( taskDefinition : ecs . TaskDefinition | undefined ,
478
+ taskDefinitionInput : sfn . TaskInput | undefined ) : iam . PolicyStatement [ ] {
473
479
const policyStatements : Array < iam . PolicyStatement > = [ ] ;
474
480
475
- if ( this . props . taskDefinition !== undefined ) {
481
+ if ( taskDefinition !== undefined ) {
476
482
policyStatements . push (
477
483
new iam . PolicyStatement ( {
478
484
actions : [ 'ecs:RunTask' ] ,
479
485
resources : [ cdk . FeatureFlags . of ( this ) . isEnabled ( STEPFUNCTIONS_TASKS_FIX_RUN_ECS_TASK_POLICY )
480
- ? this . getTaskDefinitionArn ( this . props . taskDefinition )
481
- : this . getTaskDefinitionFamilyArn ( this . props . taskDefinition ) + ':*' ] ,
486
+ ? this . getTaskDefinitionArn ( taskDefinition )
487
+ : this . getTaskDefinitionFamilyArn ( taskDefinition ) + ':*' ] ,
482
488
} ) ,
483
489
) ;
484
- } else if ( this . props . taskDefinitionInput !== undefined ) {
490
+ } else if ( taskDefinitionInput !== undefined ) {
485
491
policyStatements . push (
486
492
new iam . PolicyStatement ( {
487
493
actions : [ 'ecs:RunTask' ] ,
@@ -506,23 +512,24 @@ export class EcsRunTask extends sfn.TaskStateBase implements ec2.IConnectable {
506
512
return policyStatements ;
507
513
}
508
514
509
- private makeIamPassRolePolicyStatements ( ) : iam . PolicyStatement [ ] {
515
+ private makeIamPassRolePolicyStatements ( taskDefinition : ecs . TaskDefinition | undefined ,
516
+ taskDefinitionInput : sfn . TaskInput | undefined ) : iam . PolicyStatement [ ] {
510
517
const policyStatements : Array < iam . PolicyStatement > = [ ] ;
511
518
512
- if ( this . props . taskDefinition !== undefined ) {
519
+ if ( taskDefinition !== undefined ) {
513
520
// Need to be able to pass both Task and Execution role
514
521
const rolesRequiringPassRole = new Array < iam . IRole > ( ) ;
515
- rolesRequiringPassRole . push ( this . props . taskDefinition . taskRole ) ;
516
- if ( this . props . taskDefinition . executionRole ) {
517
- rolesRequiringPassRole . push ( this . props . taskDefinition . executionRole ) ;
522
+ rolesRequiringPassRole . push ( taskDefinition . taskRole ) ;
523
+ if ( taskDefinition . executionRole ) {
524
+ rolesRequiringPassRole . push ( taskDefinition . executionRole ) ;
518
525
}
519
526
policyStatements . push (
520
527
new iam . PolicyStatement ( {
521
528
actions : [ 'iam:PassRole' ] ,
522
529
resources : rolesRequiringPassRole . map ( ( r ) => r . roleArn ) ,
523
530
} ) ,
524
531
) ;
525
- } else if ( this . props . taskDefinitionInput !== undefined ) {
532
+ } else if ( taskDefinitionInput !== undefined ) {
526
533
// Need to be able to pass both task and execution role
527
534
const rolesRequiringPassRole = new Array < iam . IRole > ( ) ;
528
535
if ( this . props . taskRole !== undefined ) {
@@ -571,10 +578,11 @@ export class EcsRunTask extends sfn.TaskStateBase implements ec2.IConnectable {
571
578
return policyStatements ;
572
579
}
573
580
574
- private makePolicyStatements ( ) : iam . PolicyStatement [ ] {
581
+ private makePolicyStatements ( taskDefinition : ecs . TaskDefinition | undefined ,
582
+ taskDefinitionInput : sfn . TaskInput | undefined ) : iam . PolicyStatement [ ] {
575
583
return [
576
- ...this . makeEcsPolicyStatements ( ) ,
577
- ...this . makeIamPassRolePolicyStatements ( ) ,
584
+ ...this . makeEcsPolicyStatements ( taskDefinition , taskDefinitionInput ) ,
585
+ ...this . makeIamPassRolePolicyStatements ( taskDefinition , taskDefinitionInput ) ,
578
586
...this . makeEventBridgePolicyStatements ( ) ,
579
587
] ;
580
588
}
0 commit comments