feat: add integ test

Author: ren-yamanashi

packages/@aws-cdk-testing/framework-integ/test/aws-ecs/test/base/integ.service-connect-tls-configuration.ts

@@ -0,0 +1,74 @@
+import * as integ from '@aws-cdk/integ-tests-alpha';
+import * as cdk from 'aws-cdk-lib';
+import * as ec2 from 'aws-cdk-lib/aws-ec2';
+import * as ecs from 'aws-cdk-lib/aws-ecs';
+import * as iam from 'aws-cdk-lib/aws-iam';
+import * as kms from 'aws-cdk-lib/aws-kms';
+import * as acm from 'aws-cdk-lib/aws-acmpca';
+
+const app = new cdk.App();
+const stack = new cdk.Stack(app, 'aws-ecs-integ');
+const vpc = new ec2.Vpc(stack, 'Vpc');
+const cluster = new ecs.Cluster(stack, 'EcsCluster', {
+  vpc,
+  defaultCloudMapNamespace: {
+    name: 'api.com',
+    useForServiceConnect: true,
+  },
+});
+
+const taskDefinition = new ecs.FargateTaskDefinition(stack, 'TaskDef');
+
+const ca = acm.CertificateAuthority.fromCertificateAuthorityArn(stack, 'CA',
+  'arn:aws:acm-pca:us-east-1:1234567890:certificate-authority/xxxxxx',
+);
+
+const kmsKey = new kms.Key(stack, 'KmsKey', {
+  enableKeyRotation: true,
+});
+kmsKey.applyRemovalPolicy(cdk.RemovalPolicy.DESTROY);
+
+taskDefinition.addContainer('container', {
+  image: ecs.ContainerImage.fromRegistry('amazon/amazon-ecs-sample'),
+  portMappings: [
+    {
+      name: 'api',
+      containerPort: 80,
+    },
+  ],
+});
+
+const role = new iam.Role(stack, 'Role', {
+  assumedBy: new iam.ServicePrincipal('ecs.amazonaws.com'),
+  managedPolicies: [
+    iam.ManagedPolicy.fromAwsManagedPolicyName('AWSPrivateCAFullAccess'),
+  ],
+});
+role.applyRemovalPolicy(cdk.RemovalPolicy.DESTROY);
+
+kmsKey.grant(role, 'kms:GenerateDataKeyPair');
+
+new ecs.FargateService(stack, 'FargateService', {
+  cluster,
+  taskDefinition,
+  serviceConnectConfiguration: {
+    services: [
+      {
+        portMappingName: 'api',
+        dnsName: 'api',
+        port: 80,
+        tls: {
+          awsPcaAuthorityArn: ca.certificateAuthorityArn,
+          role,
+          kmsKey,
+        },
+      },
+    ],
+  },
+});
+
+new integ.IntegTest(app, 'aws-ecs-service-connect-tls-configuration', {
+  testCases: [stack],
+});
+
+app.synth();

packages/aws-cdk-lib/aws-ecs/lib/base/base-service.ts

@@ -952,10 +952,10 @@ export abstract class BaseService extends Resource
 
       const tls: CfnService.ServiceConnectTlsConfigurationProperty | undefined = svc.tls ? {
         issuerCertificateAuthority: {
-          awsPcaAuthorityArn: svc.tls?.awsPcaAuthorityArn,
+          awsPcaAuthorityArn: svc.tls.awsPcaAuthorityArn,
         },
-        kmsKey: svc.tls?.kmsKey?.keyArn,
-        roleArn: svc.tls?.role?.roleArn,
+        kmsKey: svc.tls.kmsKey?.keyArn,
+        roleArn: svc.tls.role?.roleArn,
       } : undefined;
 
       return {
@@ -1035,6 +1035,7 @@ export abstract class BaseService extends Resource
         !this.isValidPort(serviceConnectService.port)) {
         throw new Error(`Client Alias port ${serviceConnectService.port} is not valid.`);
       }
+
       // tls.awsPcaAuthorityArn should be an ARN
       const awsPcaAuthorityArn = serviceConnectService.tls?.awsPcaAuthorityArn;
       if (awsPcaAuthorityArn && !Token.isUnresolved(awsPcaAuthorityArn) && !awsPcaAuthorityArn.startsWith('arn:')) {