fix(ecs): EC2 metadata access is blocked when using EC2 capacity provider for autoscaling

packages/@aws-cdk-testing/framework-integ/test/aws-ecs/test/ec2/integ.app-mesh-proxy-config.js.snapshot/aws-ecs-integ-appmesh-proxy.template.json

@@ -919,12 +919,28 @@
    "Properties": {
     "ContainerDefinitions": [
      {
+      "Environment": [
+       {
+        "Name": "AWS_REGION",
+        "Value": {
+         "Ref": "AWS::Region"
+        }
+       }
+      ],
       "Essential": true,
       "Image": "amazon/amazon-ecs-sample",
       "Memory": 256,
       "Name": "web"
      },
      {
+      "Environment": [
+       {
+        "Name": "AWS_REGION",
+        "Value": {
+         "Ref": "AWS::Region"
+        }
+       }
+      ],
       "Essential": true,
       "Image": "envoyproxy/envoy:v1.16.2",
       "Memory": 256,

packages/@aws-cdk-testing/framework-integ/test/aws-ecs/test/ec2/integ.firelens-s3-config.js.snapshot/aws-ecs-integ.template.json

@@ -964,6 +964,14 @@
       "Name": "log_router"
      },
      {
+      "Environment": [
+       {
+        "Name": "AWS_REGION",
+        "Value": {
+         "Ref": "AWS::Region"
+        }
+       }
+      ],
       "Essential": true,
       "Image": "nginx",
       "LogConfiguration": {

packages/@aws-cdk-testing/framework-integ/test/aws-ecs/test/ec2/integ.lb-awsvpc-nw.js.snapshot/aws-ecs-integ.template.json

@@ -919,6 +919,18 @@
    "Properties": {
     "ContainerDefinitions": [
      {
+      "Environment": [
+       {
+        "Name": "SOME_VARIABLE",
+        "Value": "value"
+       },
+       {
+         "Name": "AWS_REGION",
+         "Value": {
+           "Ref": "AWS::Region"
+         }
+       }
+     ],
       "Essential": true,
       "Image": "amazon/amazon-ecs-sample",
       "Memory": 256,

packages/@aws-cdk-testing/framework-integ/test/aws-ecs/test/ec2/integ.lb-awsvpc-nw.ts

@@ -20,6 +20,9 @@ const taskDefinition = new ecs.Ec2TaskDefinition(stack, 'TaskDef', {
 const container = taskDefinition.addContainer('web', {
   image: ecs.ContainerImage.fromRegistry('amazon/amazon-ecs-sample'),
   memoryLimitMiB: 256,
+  environment: {
+    SOME_VARIABLE: 'value',
+  },
 });
 
 container.addPortMappings({

packages/@aws-cdk-testing/framework-integ/test/aws-ecs/test/ec2/integ.pseudo-terminal.js.snapshot/aws-ecs-integ-pseudo-terminal.template.json

@@ -919,6 +919,14 @@
    "Properties": {
     "ContainerDefinitions": [
      {
+      "Environment": [
+       {
+        "Name": "AWS_REGION",
+        "Value": {
+         "Ref": "AWS::Region"
+        }
+       }
+      ],
       "Essential": true,
       "Image": "amazon/amazon-ecs-sample",
       "Memory": 256,

packages/@aws-cdk-testing/framework-integ/test/aws-ecs/test/ec2/integ.sd-awsvpc-nw.js.snapshot/aws-ecs-integ-ecs.template.json

@@ -928,6 +928,14 @@
    "Properties": {
     "ContainerDefinitions": [
      {
+      "Environment": [
+       {
+        "Name": "AWS_REGION",
+        "Value": {
+         "Ref": "AWS::Region"
+        }
+       }
+      ],
       "Essential": true,
       "Image": "amazon/amazon-ecs-sample",
       "Memory": 256,

packages/aws-cdk-lib/aws-ecs/lib/ec2/ec2-task-definition.ts

@@ -1,16 +1,18 @@
 import { Construct } from 'constructs';
+import { Stack } from '../../../core';
 import { ImportedTaskDefinition } from '../base/_imported-task-definition';
 import {
   CommonTaskDefinitionAttributes,
   CommonTaskDefinitionProps,
   Compatibility,
+  InferenceAccelerator,
   IpcMode,
   ITaskDefinition,
   NetworkMode,
   PidMode,
   TaskDefinition,
-  InferenceAccelerator,
 } from '../base/task-definition';
+import { ContainerDefinition, ContainerDefinitionOptions } from '../container-definition';
 import { PlacementConstraint } from '../placement';
 
 /**
@@ -83,7 +85,6 @@ export interface Ec2TaskDefinitionAttributes extends CommonTaskDefinitionAttribu
  * @resource AWS::ECS::TaskDefinition
  */
 export class Ec2TaskDefinition extends TaskDefinition implements IEc2TaskDefinition {
-
   /**
    * Imports a task definition from the specified task definition ARN.
    */
@@ -146,4 +147,22 @@ export class Ec2TaskDefinition extends TaskDefinition implements IEc2TaskDefinit
     // Validate the placement constraints
     Ec2TaskDefinition.validatePlacementConstraints(props.placementConstraints ?? []);
   }
+
+  /**
+   * Tasks running in AWSVPC networking mode requires an additional environment variable for the region to be sourced.
+   * This override adds in the additional environment variable as required
+   */
+  override addContainer(id: string, props: ContainerDefinitionOptions): ContainerDefinition {
+    if (this.networkMode === NetworkMode.AWS_VPC) {
+      return super.addContainer(id, {
+        ...props,
+        environment: {
+          ...props.environment,
+          AWS_REGION: Stack.of(this).region,
+        },
+      });
+    }
+    // If network mode is not AWSVPC, then just add the container as normal
+    return super.addContainer(id, props);
+  }
 }

packages/aws-cdk-lib/aws-ecs/test/ec2/ec2-task-definition.test.ts

@@ -1110,6 +1110,126 @@ describe('ec2 task definition', () => {
         }],
       });
     });
+
+    test('correctly sets env variables when using EC2 capacity provider with AWSVPC mode - with no other user-defined env variables', () => {
+      // GIVEN AWS-VPC network mode
+      const stack = new cdk.Stack();
+      const taskDefiniton = new ecs.Ec2TaskDefinition(stack, 'Ec2TaskDef', {
+        networkMode: ecs.NetworkMode.AWS_VPC,
+      });
+      taskDefiniton.addContainer('some-container', {
+        image: ecs.ContainerImage.fromRegistry('amazon/amazon-ecs-sample'),
+        memoryLimitMiB: 512,
+      });
+
+      // THEN it should include the AWS_REGION env variable - when no user defined env variables are provided
+      Template.fromStack(stack).hasResourceProperties('AWS::ECS::TaskDefinition', {
+        NetworkMode: ecs.NetworkMode.AWS_VPC,
+        ContainerDefinitions: [{
+          Name: 'some-container',
+          Image: 'amazon/amazon-ecs-sample',
+          Memory: 512,
+          Environment: [{
+            Name: 'AWS_REGION',
+            Value: {
+              Ref: 'AWS::Region',
+            },
+          }],
+        }],
+      });
+    });
+
+    test('correctly sets env variables when using EC2 capacity provider with AWSVPC mode - with other user-defined env variables', () => {
+      // GIVEN AWS-VPC network mode
+      const stack = new cdk.Stack();
+      const taskDefiniton = new ecs.Ec2TaskDefinition(stack, 'Ec2TaskDef', {
+        networkMode: ecs.NetworkMode.AWS_VPC,
+      });
+      taskDefiniton.addContainer('some-container', {
+        image: ecs.ContainerImage.fromRegistry('amazon/amazon-ecs-sample'),
+        memoryLimitMiB: 512,
+        environment: {
+          SOME_VARIABLE: 'some-value',
+        },
+      });
+
+      // THEN it should include the AWS_REGION env variable
+      Template.fromStack(stack).hasResourceProperties('AWS::ECS::TaskDefinition', {
+        NetworkMode: ecs.NetworkMode.AWS_VPC,
+        ContainerDefinitions: [{
+          Name: 'some-container',
+          Image: 'amazon/amazon-ecs-sample',
+          Memory: 512,
+          Environment: [{
+            Name: 'SOME_VARIABLE',
+            Value: 'some-value',
+          }, {
+            Name: 'AWS_REGION',
+            Value: {
+              Ref: 'AWS::Region',
+            },
+          }],
+        }],
+      });
+    });
+
+    test('correctly sets env variables when using EC2 capacity provider with HOST mode', () => {
+      // GIVEN HOST network mode
+      const stack = new cdk.Stack();
+      const taskDefiniton = new ecs.Ec2TaskDefinition(stack, 'Ec2TaskDef', {
+        networkMode: ecs.NetworkMode.HOST,
+      });
+      taskDefiniton.addContainer('some-container', {
+        image: ecs.ContainerImage.fromRegistry('amazon/amazon-ecs-sample'),
+        memoryLimitMiB: 512,
+        environment: {
+          SOME_VARIABLE: 'some-value',
+        },
+      });
+
+      // THEN it should not include the AWS_REGION env variable
+      Template.fromStack(stack).hasResourceProperties('AWS::ECS::TaskDefinition', {
+        NetworkMode: ecs.NetworkMode.HOST,
+        ContainerDefinitions: [{
+          Name: 'some-container',
+          Image: 'amazon/amazon-ecs-sample',
+          Memory: 512,
+          Environment: [{
+            Name: 'SOME_VARIABLE',
+            Value: 'some-value',
+          }],
+        }],
+      });
+    });
+
+    test('correctly sets env variables when using EC2 capacity provider with BRIDGE mode', () => {
+      // GIVEN HOST network mode
+      const stack = new cdk.Stack();
+      const taskDefiniton = new ecs.Ec2TaskDefinition(stack, 'Ec2TaskDef', {
+        networkMode: ecs.NetworkMode.BRIDGE,
+      });
+      taskDefiniton.addContainer('some-container', {
+        image: ecs.ContainerImage.fromRegistry('amazon/amazon-ecs-sample'),
+        memoryLimitMiB: 512,
+        environment: {
+          SOME_VARIABLE: 'some-value',
+        },
+      });
+
+      // THEN it should not include the AWS_REGION env variable
+      Template.fromStack(stack).hasResourceProperties('AWS::ECS::TaskDefinition', {
+        NetworkMode: ecs.NetworkMode.BRIDGE,
+        ContainerDefinitions: [{
+          Name: 'some-container',
+          Image: 'amazon/amazon-ecs-sample',
+          Memory: 512,
+          Environment: [{
+            Name: 'SOME_VARIABLE',
+            Value: 'some-value',
+          }],
+        }],
+      });
+    });
   });
 
   describe('setting inferenceAccelerators', () => {