[ecs] AutoScalingGroup.UserData contains invalid commands for Windows nodes

If ECS AutoScalingGroup is used with Windows containers, resulting UserData has invalid commands, not applicable to Windows nodes:

<powershell>
  echo ECS_CLUSTER=win-cluster611F8AFF-UX2YM1DXYE1E >> /etc/ecs/ecs.config
  sudo iptables --insert FORWARD 1 --in-interface docker+ --destination 169.254.169.254/32 --jump DROP
  sudo service iptables save
  echo ECS_AWSVPC_BLOCK_IMDS=true >> /etc/ecs/ecs.config
</powershell>

There is no way to override this, as far as I can tell. Here is the responsible code:

https://github.com/aws/aws-cdk/blob/fff798c0be3611671050dee8eb8c55de645a7527/packages/%40aws-cdk/aws-ecs/lib/cluster.ts#L186-L196

Reproduction Steps

Here is the snippet (in C#, TypeScript would be a direct equivalent):

    var userData = UserData.ForWindows();

    // It is necessary to run this command to join the cluster
    userData.AddCommands($"Initialize-ECSAgent -Cluster {cluster.ClusterName} -EnableTaskIAMRole -LoggingDrivers '[\"json-file\",\"awslogs\"]'");

    var autoScalingGroup = new AutoScalingGroup(this, "autoScalingGroup", new AutoScalingGroupProps
    {
        // ...
        UserData = userData
    });

    cluster.AddAutoScalingGroup(autoScalingGroup);

Resulting CloudFormation:

      UserData:
        Fn::Base64:
          Fn::Join:
            - ""
            - - "<powershell>Initialize-ECSAgent -Cluster "
              - Ref: cluster611F8AFF
              - >-2
                 -EnableTaskIAMRole -LoggingDrivers '["json-file","awslogs"]'
                echo ECS_CLUSTER=
              - Ref: cluster611F8AFF
              - >-2
                 >> /etc/ecs/ecs.config
                sudo iptables --insert FORWARD 1 --in-interface docker+ --destination 169.254.169.254/32 --jump DROP

                sudo service iptables save

                echo ECS_AWSVPC_BLOCK_IMDS=true >> /etc/ecs/ecs.config</powershell>

Other

I believe what we are trying to do here is to codify the best practices for cluster nodes so CDK customer does not need to worry about these details. The problem is that the best practices are different between Linux and Windows platforms.

At the moment Windows cluster nodes have to be configured manually, according to AWS docs.

It would be great to incorporate these guidelines into CDK to streamline ECS cluster creation for Windows AMIs.

[ghost]

I figured out how to mutate the user data.

const launchConfig = asg.node.findChild('LaunchConfig') as CfnLaunchConfiguration;
    const userDataScript = '<powershell>Import-Module ECSTools' + '\n' + `Initialize-ECSAgent -Cluster ${ecsCluster.clusterName} -EnableTaskIAMRole</powershell>`+ '\n' +'<persist>true</persist>';
    launchConfig.addPropertyOverride('UserData', Fn.base64(userDataScript));

[github-actions[bot]]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see. If you need more assistance, please either tag a team member or open a new issue that references this one. If you wish to keep having a conversation with other community members under this issue feel free to do so.