feat(ecs): add fargate ephemeral storage encryption to cluster settings

[jaecktec]

Issue # (if applicable)

Closes #30721

Reason for this change

Expose api on ECS L2 Cluster construct to encrypt fargate ephemeral storage

Description of changes

adds new property to pass key for encrypton.
Updates key policy according to developer documentation

Description of how you validated changes

Added unit tests to validate cases where cluster has a generated name or a specified name.

When name is random, the key policy can't be as restrictive since it will generate a cyclic dependency issue due to the Key Policy being inline in KMS

Checklist

• My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[aws-cdk-automation]

The pull request linter has failed. See the aws-cdk-automation comment below for failure reasons. If you believe this pull request should receive an exemption, please comment and provide a justification.

A comment requesting an exemption should contain the text Exemption Request. Additionally, if clarification is needed add Clarification Request to a comment.

✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.

[lpizzinidev]

Thanks 👍 Left some comments for adjustments

[jaecktec]

TBH this integration test stuff is so frustrating.. it works on my machine + account. I have no idea why it always fails in the pipeline.... the logs are not very helpful either

[daschaa]

@jaecktec Other snapshots have changed (I guess due to your changes). Just make sure to update those and I think you're good to go.

Below I added a snippet of some changes, there are more in the logs.

@aws-cdk-testing/framework-integ:   CHANGED    aws-stepfunctions-tasks/test/ecs/integ.fargate-task 1.141s
@aws-cdk-testing/framework-integ:       Resources
@aws-cdk-testing/framework-integ: [~] AWS::ECS::Cluster FargateCluster7CCD5F93 
@aws-cdk-testing/framework-integ:  └─ [+] Configuration
@aws-cdk-testing/framework-integ:      └─ {}
@aws-cdk-testing/framework-integ:   UNCHANGED  aws-stepfunctions-tasks/test/emr/integ.emr-create-cluster-add-step-runtime-role 1.112s
@aws-cdk-testing/framework-integ:   CHANGED    aws-stepfunctions-tasks/test/ecs/integ.fargate-run-task 1.219s
@aws-cdk-testing/framework-integ:       Resources
@aws-cdk-testing/framework-integ: [~] AWS::ECS::Cluster FargateCluster7CCD5F93 
@aws-cdk-testing/framework-integ:  └─ [+] Configuration
@aws-cdk-testing/framework-integ:      └─ {}
@aws-cdk-testing/framework-integ:   CHANGED    aws-stepfunctions-tasks/test/ecs/integ.ec2-run-task 1.426s
@aws-cdk-testing/framework-integ:       Resources
@aws-cdk-testing/framework-integ: [~] AWS::ECS::Cluster Ec2ClusterEE43E89D 
@aws-cdk-testing/framework-integ:  └─ [+] Configuration
@aws-cdk-testing/framework-integ:      └─ {}
@aws-cdk-testing/framework-integ:   CHANGED    aws-stepfunctions-tasks/test/ecs/integ.ec2-task 1.39s
@aws-cdk-testing/framework-integ:       Resources
@aws-cdk-testing/framework-integ: [~] AWS::ECS::Cluster FargateCluster7CCD5F93 
@aws-cdk-testing/framework-integ:  └─ [+] Configuration
@aws-cdk-testing/framework-integ:      └─ {}

[GavinZZ]

Nice, thanks for contributing!

[mergify]

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

[mergify]

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

Pull request has been modified.

[mergify]

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

[mergify]

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

[aws-cdk-automation]

AWS CodeBuild CI Report

• CodeBuild project: AutoBuildv2Project1C6BFA3F-wQm2hXv2jqQv
• Commit ID: 2d6f003
• Result: SUCCEEDED
• Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

[mergify]

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

[github-actions]

Comments on closed issues and PRs are hard for our team to see.
If you need help, please open a new issue that references this one.