(aws-events-targets/EcsTask): Cannot pass the entire event to ECS task

[jbellavance34]

Describe the bug

Using the aws-events-targets/EcsTask class, I cannot pass the entire event. Which should be the default behavior.

A similair issue was raised in #15785

I don't think the input section of the rule should contain an empty json object by default since the ECS task wont get the payload of the event rule.

Maybe I missunderstood this class and I dont use it correctly.

My goal is to use the default event rule behavior and pass the entire rule event to the ECS Task, which is the default bheavior in other target types like aws lambda ( https://github.com/aws/aws-cdk/blob/main/packages/aws-cdk-lib/aws-events-targets/lib/lambda.ts#L8).

Regression Issue

• Select this option if this issue appears to be a regression.

Last Known Working CDK Library Version

No response

Expected Behavior

As stated in the aws-events/RuleTargetConfig interface, the default behavior should be the entire event https://github.com/aws/aws-cdk/blob/main/packages/aws-cdk-lib/aws-events/lib/target.ts#L113

Current Behavior

The input section is automatically generated from this function https://github.com/aws/aws-cdk/blob/main/packages/aws-cdk-lib/aws-events-targets/lib/ecs-task.ts#L325 and result in an empty object of containerOverrides is empty.

      Targets:
        - Arn:
            Fn::GetAtt:
              - eventBusEcsTaskPaternscheduledfargateclusterBF03F136
              - Arn
          EcsParameters:
            LaunchType: FARGATE
            NetworkConfiguration:
              AwsVpcConfiguration:
                AssignPublicIp: DISABLED
                SecurityGroups:
                  - Fn::GetAtt:
                      - eventBusEcsTaskPaternsecurityGroup1C7DA4F1
                      - GroupId
                Subnets:
                  - subnet-0b81dac4c59ff9b88
                  - subnet-0baf828bb16b9c6d2
                  - subnet-0f2a0fec4166a49e0
            TaskCount: 1
            TaskDefinitionArn:
              Ref: eventBusEcsTaskPaternecstasktargettaskdef7FCD529A
          Id: Target0
          Input: "{}"
          RoleArn:
            Fn::GetAtt:
              - eventBusEcsTaskPaternecstasktargettaskdefEventsRole6C5990A7
              - Arn

If I add containerOverrides, the input changes the JSON object that filters the event sent to ECS.

this.ecsTaskTarget = new EcsTaskTarget({
    cluster: this.ecsCluster,
    taskDefinition: this.taskDefinition,
    assignPublicIp: false, // enforcé
    launchType: LaunchType.FARGATE, // enforcé
    securityGroups: [this.securityGroup.securityGroup],
    subnetSelection: props.paramTargetEcsTask.paramVpc.selectSubnets({
        subnetType: paramTaskSubnetType
    }),
    taskCount: paramDesiredTaskCount,
    containerOverrides: [
        {
            containerName: 'test'
        }
    ]

});

cdk diff output

[~] AWS::Events::Rule eventBusEcsTaskPatern/rule-CDK-TEST-s3-create-iaws-lab-event-bus-ecs eventBusEcsTaskPaternruleCDKTESTs3createiawslabeventbusecs87D7D6F4
 └─ [~] Targets
     └─ @@ -32,7 +32,7 @@
        [ ]   }
        [ ] },
        [ ] "Id": "Target0",
        [-] "Input": "{}",
        [+] "Input": "{\"containerOverrides\":[{\"name\":\"test\"}]}",
        [ ] "RoleArn": {
        [ ]   "Fn::GetAtt": [
        [ ]     "eventBusEcsTaskPaternecstasktargettaskdefEventsRole6C5990A7",

Reproduction Steps

• Create an event rule using Rule from aws-cdk-lib/aws-events
• Add a target using EcsTask from aws-cdk-lib/aws-events-targets

Possible Solution

I will look into the L1 classes since the L2 class it seems impossible to pass the entire event to the ECS Task.

Additional Information/Context

No response

AWS CDK Library version (aws-cdk-lib)

2.185.0

AWS CDK CLI version

2.1007.0

Node.js Version

v18.20.4

OS

linux

Language

TypeScript

Language Version

4.9.5

Other information

No response

[ykethan]

Hey @jbellavance34, thank you for reaching out and reporting. I was able to reproduce the issue using the following reproduction doee.

import * as cdk from 'aws-cdk-lib';
import { Stack, StackProps, CfnOutput } from 'aws-cdk-lib';
import { Construct } from 'constructs';
import * as events from 'aws-cdk-lib/aws-events';
import * as targets from 'aws-cdk-lib/aws-events-targets';
import * as lambda from 'aws-cdk-lib/aws-lambda';
import * as ecs from 'aws-cdk-lib/aws-ecs';
import * as ec2 from 'aws-cdk-lib/aws-ec2';

export class BugStack extends Stack {
  constructor(scope: Construct, id: string, props?: StackProps) {
    super(scope, id, props);

    // Create a VPC for ECS
    const vpc = new ec2.Vpc(this, 'Vpc', {
      maxAzs: 2,
    });

    // Create an ECS cluster
    const cluster = new ecs.Cluster(this, 'Cluster', {
      vpc,
    });

    // Create a Task Definition
    const taskDefinition = new ecs.TaskDefinition(this, 'TaskDef', {
      compatibility: ecs.Compatibility.FARGATE,
      cpu: '256',
      memoryMiB: '512',
    });

    // Add a container to the Task Definition
    taskDefinition.addContainer('Container', {
      image: ecs.ContainerImage.fromRegistry('amazon/amazon-ecs-sample'),
      logging: new ecs.AwsLogDriver({ streamPrefix: 'event-demo' }),
    });

    // Create a simple Lambda function
    const fn = new lambda.Function(this, 'EventHandlerFunction', {
      runtime: lambda.Runtime.NODEJS_18_X,
      handler: 'index.handler',
      code: lambda.Code.fromInline(`
        exports.handler = async (event) => {
          console.log('Event received:', JSON.stringify(event));
          return { statusCode: 200 };
        };
      `),
    });

    // Create an EventBridge rule
    const rule = new events.Rule(this, 'Rule', {
      eventPattern: {
        source: ['test-source'],
      },
    });

    // Add Lambda as a target
    rule.addTarget(new targets.LambdaFunction(fn));

    // Add ECS Task as a target 
    rule.addTarget(
      new targets.EcsTask({
        cluster,
        taskDefinition,
        taskCount: 1,
      }),
    );
  }
}

CDK synth output:

Targets:
  # Lambda target (gets full event by default - no Input property)
  - Arn: [Lambda Function ARN]
    Id: Target0
    
  # ECS Task target (always has explicit Input)
  - Arn: [Cluster ARN]
    # ...
    Id: Target1
    Input: "{}"  # <-- This prevents receiving the full event
    # ...

The issue occurs in ecs-task.ts where the bind() method always explicitly sets an input value:

return {
  // ...
  input: events.RuleTargetInput.fromObject(input), // Always sets an input
  // ...
};

From the documentation by default if input is not provided the entire event is passed as bind() method always explicitly sets an input value this generated this always sets Input: "{}"

Using CfnRule (L1 construct) and not specifying the Input property does appear to be a workaround.

Example:

   // Create the Rule using L1 constructs
    const cfnRule = new events.CfnRule(this, 'Rule', {
      eventPattern: {
        source: ['test-source'],
      },
      targets: [
        {
          arn: cluster.clusterArn,
          id: 'EcsTaskTarget',
          roleArn: ecsEventsRole.roleArn,
          ecsParameters: {
            taskDefinitionArn: taskDefinition.taskDefinitionArn,
            taskCount: 1,
            launchType: 'FARGATE',
            networkConfiguration: {
              awsVpcConfiguration: {
                subnets: vpc.privateSubnets.map((s) => s.subnetId),
                assignPublicIp: 'DISABLED',
                securityGroups: [securityGroup.securityGroupId],
              },
            },
          },
          // No input specified = full event will be passed
        },
      ],
    });

Marking as P2 bug.

[jbellavance34]

@ykethan Thank you for the quick update.

I will try the provided L1 construct code.

[jbellavance34]

FYI, changing the rule creation from the L2 construct to the L1 construct was causing the rule to be re-created.

Since in our usecase we mostly always want the complete event payload to be passed to the target, I've used the escape hatch to remove the default empty input to the L2 object.

const cfn_created_rule = created_rule.node.defaultChild as CfnRule
cfn_created_rule.addPropertyDeletionOverride('Targets.0.Input')

cdk diff shows that the empty JSON object is removed

Resources
[~] AWS::Events::Rule eventBusEcsTaskPatern/rule-CDK-TEST-s3-create-iaws-lab-event-bus-ecs eventBusEcsTaskPaternruleCDKTESTs3createiawslabeventbusecs87D7D6F4
 └─ [~] Targets
     └─ @@ -32,7 +32,6 @@
        [ ]   }
        [ ] },
        [ ] "Id": "Target0",
        [-] "Input": "{}",
        [ ] "RoleArn": {
        [ ]   "Fn::GetAtt": [
        [ ]     "eventBusEcsTaskPaternecstasktargettaskdefEventsRole6C5990A7",

The input is now the default behavior, Matched event

[pahud]

// In packages/aws-cdk-lib/aws-events-targets/lib/ecs-task.ts
private createInput(): Record<string, any> {
  const containerOverrides = this.props.containerOverrides && this.props.containerOverrides
    .map(({ containerName, ...overrides }) => ({ name: containerName, ...overrides }));

  // See https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_TaskOverride.html
  return {
    // In prior versions, containerOverrides was passed even when undefined, so we always set it for backward compatibility.
    containerOverrides,
    // ... other properties
  };
}

The issue is that this method always returns an object with containerOverrides (even if it's undefined), which is then passed to events.RuleTargetInput.fromObject(input) in the bind() method. According to the CloudFormation documentation, when Input is specified, it overrides the matched event.

// In packages/aws-cdk-lib/aws-events-targets/lib/lambda.ts
return {
  ...bindBaseTargetConfig(this.props),
  arn: this.handler.functionArn,
  input: this.props.event, // This is undefined by default
  targetResource: this.handler,
};

Possible Fixes/Solutions

1. Add an option to pass the entire event: Introduce a new property in EcsTaskProps like passEntireEvent that, when set to true, would not set any input, allowing the entire event to be passed. (no breaking changes)

2. Change the default behavior: Modify the createInput() method to return undefined when no overrides are specified, which would result in no input being set and the entire event being passed. (might require a feature flag)

3. Use L1 constructs: As a workaround, users can use lower-level constructs to manually configure the target without specifying an input. (not-so-good workaround)

4. Use addPropertyOverride() from L2 like (good workaround)

// Create your rule and EcsTask target as usual
const rule = new events.Rule(this, 'MyRule', {
  eventPattern: {
    // your event pattern
  }
});

const ecsTaskTarget = new targets.EcsTask({
  cluster: myCluster,
  taskDefinition: myTaskDefinition,
  // other properties as needed
});

// Add the target to the rule
const targetId = rule.addTarget(ecsTaskTarget);

// Get the underlying CfnRule
const cfnRule = rule.node.defaultChild as events.CfnRule;

// Remove the Input property from the target
// This will allow the entire event to be passed to the ECS task
cfnRule.addPropertyOverride(`Targets.${targetId}.Input`, undefined);

For a proper fix, we would welcome a PR contribution that implements one option 1 or 2.

I will be on board with option 1 but always welcome if there's any better ideas.