feat(ecs): credentialSpecs in ContainerDefinitionOptions

packages/@aws-cdk-testing/framework-integ/test/aws-ecs/test/integ.task-definition-container-credentialspecs.ts

@@ -0,0 +1,31 @@
+import * as cdk from 'aws-cdk-lib';
+import * as ecs from 'aws-cdk-lib/aws-ecs';
+import * as iam from 'aws-cdk-lib/aws-iam';
+import { IntegTest } from '@aws-cdk/integ-tests-alpha';
+
+const app = new cdk.App();
+const stack = new cdk.Stack(app, 'aws-ecs-task-definition-container-credentialspecs');
+
+const taskExecutionRole = new iam.Role(stack, 'task-execution-role', {
+  roleName: 'aws-ecs-task-definition-container-credentialspecs-task-exec-role',
+  assumedBy: new iam.ServicePrincipal('ecs-tasks.amazonaws.com'),
+});
+taskExecutionRole.addManagedPolicy(iam.ManagedPolicy.fromAwsManagedPolicyName('service-role/AmazonECSTaskExecutionRolePolicy'));
+taskExecutionRole.addManagedPolicy(iam.ManagedPolicy.fromAwsManagedPolicyName('AmazonS3ReadOnlyAccess'));
+
+const taskDefinition = new ecs.Ec2TaskDefinition(stack, 'TaskDef', {
+  executionRole: taskExecutionRole,
+});
+
+taskDefinition.addContainer('Container', {
+  image: ecs.ContainerImage.fromRegistry('public.ecr.aws/ecs-sample-image/amazon-ecs-sample:latest'),
+  memoryReservationMiB: 32,
+  memoryLimitMiB: 512,
+  credentialSpecs: ['credentialspecdomainless:arn:aws:s3:::bucket_name/key_name'],
+});
+
+new IntegTest(app, 'TaskDefinitionContainerCredSpecs', {
+  testCases: [stack],
+});
+
+app.synth();

packages/aws-cdk-lib/aws-ecs/lib/container-definition.ts

@@ -126,6 +126,15 @@ export interface ContainerDefinitionOptions {
    */
   readonly command?: string[];
 
+  /**
+   * A list of ARNs in SSM or Amazon S3 to a credential spec (`CredSpec`) file that configures the container for Active Directory authentication.
+   *
+   * We recommend that you use this parameter instead of the `dockerSecurityOptions`. The maximum number of ARNs is 1.
+   *
+   * @default - No credential specs.
+   */
+  readonly credentialSpecs?: string[];
+
   /**
    * The minimum number of CPU units to reserve for the container.
    *
@@ -794,6 +803,7 @@ export class ContainerDefinition extends Construct {
   public renderContainerDefinition(_taskDefinition?: TaskDefinition): CfnTaskDefinition.ContainerDefinitionProperty {
     return {
       command: this.props.command,
+      credentialSpecs: this.props.credentialSpecs,
       cpu: this.props.cpu,
       disableNetworking: this.props.disableNetworking,
       dependsOn: cdk.Lazy.any({ produce: () => this.containerDependencies.map(renderContainerDependency) }, { omitEmptyArray: true }),

packages/aws-cdk-lib/aws-ecs/test/container-definition.test.ts

@@ -465,6 +465,7 @@ describe('container definition', () => {
         memoryReservationMiB: 512,
         containerName: 'Example Container',
         command: ['CMD-SHELL'],
+        credentialSpecs: ['credentialspecdomainless:arn:aws:s3:::bucket_name/key_name'],
         cpu: 128,
         disableNetworking: true,
         dnsSearchDomains: ['example.com'],
@@ -514,6 +515,9 @@ describe('container definition', () => {
               'CMD-SHELL',
             ],
             Cpu: 128,
+            CredentialSpecs: [
+              'credentialspecdomainless:arn:aws:s3:::bucket_name/key_name',
+            ],
             DisableNetworking: true,
             DnsSearchDomains: [
               'example.com',