Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
33 changes: 15 additions & 18 deletions cdk/test/constructs/ecs-agent-cluster.test.ts
Original file line number Diff line number Diff line change
Expand Up @@ -66,9 +66,14 @@ function createStack(overrides?: { memoryId?: string }): { stack: Stack; templat
}

describe('EcsAgentCluster construct', () => {
let baseTemplate: Template;

beforeAll(() => {
baseTemplate = createStack().template;
});

test('creates an ECS Cluster with container insights', () => {
const { template } = createStack();
template.hasResourceProperties('AWS::ECS::Cluster', {
baseTemplate.hasResourceProperties('AWS::ECS::Cluster', {
ClusterSettings: Match.arrayWith([
Match.objectLike({
Name: 'containerInsights',
Expand All @@ -79,8 +84,7 @@ describe('EcsAgentCluster construct', () => {
});

test('creates a Fargate task definition with 2 vCPU and 4 GB', () => {
const { template } = createStack();
template.hasResourceProperties('AWS::ECS::TaskDefinition', {
baseTemplate.hasResourceProperties('AWS::ECS::TaskDefinition', {
Cpu: '2048',
Memory: '4096',
RequiresCompatibilities: ['FARGATE'],
Expand All @@ -92,8 +96,7 @@ describe('EcsAgentCluster construct', () => {
});

test('creates a security group with TCP 443 egress only', () => {
const { template } = createStack();
template.hasResourceProperties('AWS::EC2::SecurityGroup', {
baseTemplate.hasResourceProperties('AWS::EC2::SecurityGroup', {
GroupDescription: 'ECS Agent Tasks - egress TCP 443 only',
SecurityGroupEgress: Match.arrayWith([
Match.objectLike({
Expand All @@ -107,20 +110,17 @@ describe('EcsAgentCluster construct', () => {
});

test('creates a CloudWatch log group with 3-month retention and CDK-generated name', () => {
const { template } = createStack();
template.hasResourceProperties('AWS::Logs::LogGroup', {
baseTemplate.hasResourceProperties('AWS::Logs::LogGroup', {
RetentionInDays: 90,
});
// Verify no hardcoded log group name — CDK auto-generates a unique name
const logGroups = template.findResources('AWS::Logs::LogGroup');
const logGroups = baseTemplate.findResources('AWS::Logs::LogGroup');
for (const [, lg] of Object.entries(logGroups)) {
expect((lg as any).Properties).not.toHaveProperty('LogGroupName');
}
});

test('task role has DynamoDB read/write permissions', () => {
const { template } = createStack();
template.hasResourceProperties('AWS::IAM::Policy', {
baseTemplate.hasResourceProperties('AWS::IAM::Policy', {
PolicyDocument: {
Statement: Match.arrayWith([
Match.objectLike({
Expand All @@ -136,8 +136,7 @@ describe('EcsAgentCluster construct', () => {
});

test('task role has Secrets Manager read permission', () => {
const { template } = createStack();
template.hasResourceProperties('AWS::IAM::Policy', {
baseTemplate.hasResourceProperties('AWS::IAM::Policy', {
PolicyDocument: {
Statement: Match.arrayWith([
Match.objectLike({
Expand All @@ -152,8 +151,7 @@ describe('EcsAgentCluster construct', () => {
});

test('task role has Bedrock InvokeModel permissions', () => {
const { template } = createStack();
template.hasResourceProperties('AWS::IAM::Policy', {
baseTemplate.hasResourceProperties('AWS::IAM::Policy', {
PolicyDocument: {
Statement: Match.arrayWith([
Match.objectLike({
Expand All @@ -170,8 +168,7 @@ describe('EcsAgentCluster construct', () => {
});

test('container has required environment variables', () => {
const { template } = createStack();
template.hasResourceProperties('AWS::ECS::TaskDefinition', {
baseTemplate.hasResourceProperties('AWS::ECS::TaskDefinition', {
ContainerDefinitions: Match.arrayWith([
Match.objectLike({
Name: 'AgentContainer',
Expand Down
Loading