Copilot-cli: Feature request: easy way to use a service’s task role when running a one-off task

[aviflax]

Right now I can see that a service has a task role, but I don’t see a way to programmatically and automatically get the ARN of that role and pass it to copilot task run — I need this to be dynamic because it will vary by environment, and I can’t have a manual step of retrieving the ARN.

It’d be great if there was a way to associate a one-off task with a service, just as we can currently associate it with an app and/or an environment; if so I think it’d be natural and intuitive that the one-off task would then use the task role of the service.

Alternatively, perhaps the task role ARN could be exported as a CloudFormation output, or put into an SSM param, so that I could retrieve it via a script using the AWS CLI.

(Right now I’m manually specifying a task role for one-off tasks in one of my add-ons, and then putting its ARN into an SSM param. That’s working, but it took me awhile to work it out, and it’s extra “noise” in my add-on template.)

Thank you!

[kohidave]

I think it makes total sense to add a --svc flag to task run which will run with the service's task role.

[malkovro]

Would it make sense to run it with the env variable and secrets specified in the manifest for this service as well ?
I see the _Task Run Design Command "issue"_(https://github.com/aws/copilot-cli/issues/702) mentions that one of its use-case is to allow one-off scripts requiring secrets but there is no way to currently pass those secrets to the command.

[aviflax]

Would it make sense to run it with the env variable and secrets specified in the manifest for this service as well ?

I think so, yes. I think that'd be intuitive and useful.

[efekarakus]

Thanks for the feedback that makes a lot of sense!

[efekarakus]

Hi @malkovro @aviflax ! We have a proposal to support this feature (https://github.com/aws/copilot-cli/issues/2159) we would love to hear your feedback on the issue 😄

[aviflax]

Sorry I’m not currently using Copilot, as it's not applicable to my current project. So I don't think I can give good feedback on the proposal. At a high level all the approaches look very promising though. Nice work!