Give permission to invoke lambda from ECS by cdk - amazon-web-services

Question

When Invoking lambda from ECS,Permission error comes.
botocore.exceptions.ClientError: An error occurred (AccessDeniedException) when calling the Invoke operation: User: arn:aws:sts::678100228XXX:assumed-role/vw-dev-fargate-stack-TaskDefAdminTaskRoleA25A3679-1K9EPRKUW9TNV/21bdeb6c10b14db4b1515986d946959a is not authorized to perform: lambda:InvokeFunction on resource: arn:aws:lambda:ap-northeast-1:678100228XXX:function:vw-dev-lambda because no identity-based policy allows the lambda:InvokeFunction action
So, I want to add the permission to ECS for accessing lambda.
I set ecs in ecs.ts and lambda in lambda.ts
My current idea is to give the permission to ecs in lambda.ts
in my ecs.ts
const ecsAdminService = new ecs.FargateService(this, "AdminService", {
cluster,
taskDefinition:taskDefinitionAdmin,
desiredCount: 2,
vpcSubnets: {subnetType: ec2.SubnetType.PUBLIC },
assignPublicIp: true,
securityGroups:[adminServiceSg],
enableExecuteCommand:true,
serviceName: "sw-ecs-my-dx-tokyo-jxc-91"
});
in my lambda.ts
const myLambda = new lambda.DockerImageFunction(this, "myLambda", {
functionName: `vw-${targetEnv}-lambda`,
vpc:vpc,
vpcSubnets: {subnetType: ec2.SubnetType.PRIVATE_WITH_NAT },
timeout: cdk.Duration.minutes(1),
code: lambda.DockerImageCode.fromEcr(myEcrRepo),
environment:{
}
});
# I am making here below.
const ecs = "somehow get the ecs here"
myLambda.grantInvoke(ecs) # Something like this.
Am I correct??
I am stuck with two problems.
How can I get the ecs defined in another file?
How can I give the ecs permission to invoke?
Or ,am I basically wrong?
Any help appreciated. thank you very much.

Answer 1

This is easily done by passing variables between stacks
For example in some-app
// bin/some-app.ts
import * as cdk from 'aws-cdk-lib';
import { SomeEcsStack } from '../lib/ecs';
import { SomeLambdaStack} from '../lib/lambda'
const app = new cdk.App();
const lmb = new SomeLambdaStack(app, 'SomeLambdaStack');
new SomeEcsStack(app, 'SomeEcsStack', {
lambdaFunc: lmb.lambdaFunc
});
Make your lambda function public
// lib/lambda.ts
import { Duration, Stack, StackProps } from 'aws-cdk-lib';
import * as lambda from 'aws-cdk-lib/aws-lambda';
import { Construct } from 'constructs';
export class SomeLambdaStack extends Stack {
public readonly lambdaFunc: lambda.Function; // <-- making it available
constructor(scope: Construct, id: string, props?: StackProps) {
super(scope, id, props);
const myLambda = new lambda.DockerImageFunction(this, "myLambda", {
functionName: `vw-${targetEnv}-lambda`,
vpc:vpc,
vpcSubnets: {subnetType: ec2.SubnetType.PRIVATE_WITH_NAT },
timeout: cdk.Duration.minutes(1),
code: lambda.DockerImageCode.fromEcr(myEcrRepo),
});
this.lambdaFunc = myLambda; // <-- making it available
}
Grant the ecs task definition role permissions to invoke
// lib/ecs.ts
import { Duration, Stack, StackProps } from 'aws-cdk-lib';
import * as ecs from 'aws-cdk-lib/aws-ecs';
import * as lambda from 'aws-cdk-lib/aws-lambda';
import { Construct } from 'constructs';
export interface SomeEcsStackProps extends StackProps {
readonly lambdaFunc: lambda.Function; // <-- expect lambda to be passed
}
export class SomeEcsStack extends Stack {
constructor(scope: Construct, id: string, props?: SomeEcsStackProps) {
super(scope, id, props);
const ecsAdminService = new ecs.FargateService(this, "AdminService", {
cluster,
taskDefinition:taskDefinitionAdmin,
desiredCount: 2,
vpcSubnets: {subnetType: ec2.SubnetType.PUBLIC },
assignPublicIp: true,
securityGroups:[adminServiceSg],
enableExecuteCommand:true,
serviceName: "sw-ecs-my-dx-tokyo-jxc-91"
});
props.lambdaFunc.grantInvoke(taskDefinitionAdmin.taskRole) // <-- Grant permission to task role
}