[ecs] EFS Volume configuration is not abstracted

There’s kind of a few related points on this bug, but I figured one issue was the way to go instead of multiple. Happy to split it out though if that’s better for the team.

The theme here is that EFS volume configuration is very raw and not abstracted at all in the L2 constructs for task definitions, and some things are just outright incorrect.

1. Specifying transitEncryption requires the string ENABLED or DISABLED - this should be true/false
2. If you enable an access point it tells you that you must enable transitEncryption - if this is a requirement of using an access point then it should be enabled automatically in this case
3. transitEncryption is disabled by default - I could be wrong on this, but I do not see any downside to enabling this by default, and it is a more secure option which would be more in-line with the CDK’s mission to implement best practices by default
4. If an access point is specified, the root directory value will be relative to the directory set for the access point. If specified, transit encryption must be enabled in the EFSVolumeConfiguration. -> If you try to deploy with both an access point and a root directory specified you get an error Invalid request provided: Create TaskDefinition: When using an EFS access point, the root directory must either be set to "/" or be omitted.. So at the very least the documentation is wrong, but we should catch this on the CDK side and error during creation if these are mutually exclusive options. I’d also note that the docs for cloudformation state pretty much the exact error that I get back; which is much clearer.
5. Enabling iam auth in the authorizationConfig block also advises that transitEncryption is required - Again, this should make it turn on automatically
6. When specifying an EFS filesystem and access point, you must pass in the IDs themselves, instead of the filesystem/access point objects themselves (e.g. filesystemId: fs.filesystemId instead of filesystem: fs as you’d expect)

Reproduction Steps

What did you expect to happen?

What actually happened?

Environment

• CLI Version : 1.66
• Framework Version: 1.66
• Node.js Version:
• OS :
• Language (Version):

Other

---

This is 🐛 Bug Report

[slotnick]

I wholeheartedly agree with all the points in the original (excellent) post. The experience using EFS with ECS has been uncharacteristically difficult, please give it a little love.

[revmischa]

Not clear to me how to mount an EFS access point as a volume in ECS