ECS Secrets from SSM ParamStore exceeds IAM Policy size

I’m unable to deploy my stack that makes use of ECS Secrets. I’m trying to use 58 ECS Secrets (current hard limit is 60) but how CDK is currently writing the IAM Policy for the Execution Role I’m hitting a limit with the IAM Policy.

The limit is being hit because CDK is adding a statement to the policy per parameter which creates a lot of duplication within the statement.

            Resource:
              Fn::Join:
                - ""
                - - "arn:"
                  - Ref: AWS::Partition
                  - :ssm:us-east-2:065449092177:parameter/application/parameter1
          - Action:
              - ssm:DescribeParameters
              - ssm:GetParameters
              - ssm:GetParameter
              - ssm:GetParameterHistory
            Effect: Allow

Reproduction Steps

Sorry, I don’t have a stack that I can share.

1. Create ECS Application w/60 secrets
2. cdk deploy

Error Log

Maximum policy size of 10240 bytes exceeded for role

Environment

• CLI Version : 1.44.0
• Framework Version: 1.44.0
• Node.js Version: v12.16.1
• OS : macOS 10.15.5
• Language (Version): TypeScript (3.7.2)

Other

My ideal solution would be an additional parameter for ecs.Secret.fromSsmParameter that gives the option to skip the grant. My stack already appends a Managed Policy to the Execution Role that has all of the access necessary for my application to pull the parameters.

A more immediate option would be to group all of the SSM parameter grants into a single statement to dramatically reduce the duplication of the Action statements 60 times

---

This is 🐛 Bug Report

[LeandroSoares]

Guys i had the same problem, when using an existing role, until i found the option mutable:

Role.fromRoleArn(this, 'ECSTaskExecutionRole', 'MyExecutionRoleArn', { mutable: false }),

[metlaivan]

@Plasma thx a lot for your example. It is working for Java too. Example on the Java:

public class NoOpGrantReadSecret extends Secret {

  private final Secret secretImplementation;

  public NoOpGrantReadSecret(Secret secretImplementation) {
    this.secretImplementation = secretImplementation;
  }

  @Override
  public @NotNull Grant grantRead(@NotNull IGrantable grantee) {
    return Grant.drop(grantee, "ignored");
  }

  @Override
  public @NotNull String getArn() {
    return secretImplementation.getArn();
  }

  @Override
  public @Nullable Boolean getHasField() {
    return secretImplementation.getHasField();
  }
}

Call:

  final Map<String, Secret> secretVariables = new HashMap<>();
  var secret = Secret.fromSsmParameter(StringParameter.fromSecureStringParameterAttributes(
      this,
      "service-parameter-name",
      SecureStringParameterAttributes.builder()
          .parameterName(serviceSecrets.get("/path/to/ssm"))
          .version(1)
          .build()
  ));
    secretVariables.put("ENV_VAR_NAME",new NoOpGrantReadSecret(secret));

  var ssmReadOnlyPolicy = PolicyStatement.Builder.create()
      .actions(Arrays.asList("ssm:Describe*", "ssm:Get*", "ssm:List*"))
      .resources(Collections.singletonList("*"))
      .build();

  final TaskDefinition taskDefinition = TaskDefinition.Builder.create().build();
    taskDefinition.addToExecutionRolePolicy(ssmReadOnlyPolicy);

  ContainerDefinitionOptions containerDefinitionOptions = ContainerDefinitionOptions.builder()
      .secrets(secretVariables)
      .build();