Enable ecs exec

Author: ikovac

README.md

@@ -284,5 +284,7 @@ export type WebServerArgs = {
 
 ## 🚧 TODO
 
-- [ ] Allow connection with RDS via ec2 instance
+- [x] Allow connection with RDS via ec2 instance
+- [x] Execute commands from ecs service
 - [ ] Add worker service for executing tasks
+- [ ] Update docs, describe each service, describe required stack configs...

src/components/web-server.ts

@@ -275,12 +275,35 @@ export class WebServer extends pulumi.ComponentResource {
       { parent: this },
     );
 
+    const execCmdInlinePolicy = {
+      name: 'ecs-exec',
+      policy: JSON.stringify({
+        Version: '2012-10-17',
+        Statement: [
+          {
+            Sid: 'AllowContainerToCreateECSExecSSMChannel',
+            Effect: 'Allow',
+            Action: [
+              'ssmmessages:CreateControlChannel',
+              'ssmmessages:CreateDataChannel',
+              'ssmmessages:OpenControlChannel',
+              'ssmmessages:OpenDataChannel',
+            ],
+            Resource: '*',
+          },
+        ],
+      }),
+    };
+
     const taskRole = new aws.iam.Role(
       `${name}-ecs-task-role`,
       {
         name: `${name}-ecs-task-role`,
         assumeRolePolicy,
-        inlinePolicies: argsWithDefaults.taskRoleInlinePolicies,
+        inlinePolicies: [
+          execCmdInlinePolicy,
+          ...argsWithDefaults.taskRoleInlinePolicies,
+        ],
       },
       { parent: this },
     );
@@ -322,6 +345,7 @@ export class WebServer extends pulumi.ComponentResource {
             ([containerName, image, port, environment, logGroup, region]) => {
               return JSON.stringify([
                 {
+                  readonlyRootFilesystem: true,
                   name: containerName,
                   image,
                   essential: true,
@@ -380,6 +404,7 @@ export class WebServer extends pulumi.ComponentResource {
         launchType: 'FARGATE',
         desiredCount: argsWithDefaults.desiredCount,
         taskDefinition: this.taskDefinition.arn,
+        enableExecuteCommand: true,
         loadBalancers: [
           {
             containerName: name,