(ECS): ability to add SystemControls to Container Definition

❓ General Issue

The Question

Hello, So I realized that the non-Cfn construct for the ContainerDefinition doesn’t have a way to add SystemControls (SystemControls) to it.

But it is available through ecs.CfnTaskDefinition.ContainerDefinitionProperty. Now, I’m mixing Cfn* classes with non-Cfn* classes and it could get a bit messy. I’ll be posting my code here and maybe someone already went through this and help me out.

ALSO is there way I can directly access arbitrary properties on resources? I was thinking of adding that SystemControls manually, but I couldn’t find the way.

Thanks.

Environment

• CDK CLI Version: 1.118.0 (build a4f0418)
• Module Version: “@aws-cdk/aws-ecs”: “^1.118.0”
• Node.js Version: v14.16.1
• OS: all (Windows 10)
• Language (Version): nodejs v14.16.1

Other information

const cloudwatchLog = new ecs.AwsLogDriver({
	logRetention: awsLogs.RetentionDays.ONE_WEEK,
	streamPrefix: 'activity-service-websockets-fargate-task'
});

const taskExecRole = new iam.Role(this, 'activity-service-task-exec-role', {
	roleName: 'activity-service-task-exec-role',
	assumedBy: new iam.ServicePrincipal('ecs-tasks.amazonaws.com'),
	managedPolicies: [
		iam.ManagedPolicy.fromAwsManagedPolicyName('AmazonSSMFullAccess'),
		iam.ManagedPolicy.fromAwsManagedPolicyName('CloudWatchFullAccess')
	]
});

const taskDefinition = new ecs.CfnTaskDefinition(this, 'taskdef', {
	cpu: config.Environment === 'live' ? 2048 : 512,
	memory: config.Environment === 'live' ? 4096 : 1024,
	taskRoleArn: taskExecRole.roleArn
});

const dockerContainerDef = new ecs.ContainerDefinition(this, 'activity-service-websockets-container', { // this doesn't work
	image: new ecs.AssetImage('./docker'),
	logging: cloudwatchLog,
	environment: {
		LARGE_SCALE_TEST: '1'
	},
	privileged: true,
	taskDefinition // because this is of the Cfn* flavor
});

const cfnDockerContainerDef = dockerContainerDef.renderContainerDefinition();

taskDefinition.containerDefinitions = [ cfnDockerContainerDef ];
cfnDockerContainerDef.systemControls = [
	{
		namespace: 'net.ipv4.tcp_tw_reuse',
		value: '1'
	},
	{
		namespace: 'net.ipv4.tcp_tw_recycle',
		value: '1'
	},
	{
		namespace: 'net.ipv4.tcp_fin_timeout',
		value: '60'
	}
];

[peterwoodworth]

Thanks for bringing my attention to this @schuberttobias

it’s been approved and should merge soon, so it should be out on the next CDK release

[peterwoodworth]

I’ve converted this into a feature request. I’ve been unable to find a workaround for this using L2 resources.

@Mayhem93 do you need any help with getting this to run still? Instead of using the higher level ContainerDefinition constructs, you’ll need to configure that manually in the CfnTaskDefinition