feat(ecs): enable cluster to grant task protection API permissions to IAM entities

packages/aws-cdk-lib/aws-ecs/lib/cluster.ts

@@ -598,6 +598,21 @@ export class Cluster extends Resource implements ICluster {
     });
   }
 
+  /**
+  * Grants ECS Task Protection API permissions to the specified grantee.
+  * This method provides a streamlined way to assign the 'ecs:UpdateTaskProtection'
+  * permission, enabling the grantee to manage task protection in the ECS cluster.
+  *
+  * @param grantee - The entity (e.g., IAM role or user) to grant the permissions to.
+  */
+  public grantTaskProtection(grantee: iam.IGrantable): iam.Grant {
+    return iam.Grant.addToPrincipal({
+      grantee,
+      actions: ['ecs:UpdateTaskProtection'],
+      resourceArns: [this.arnForTasks('*')],
+    });
+  }
+
   private configureWindowsAutoScalingGroup(autoScalingGroup: autoscaling.AutoScalingGroup, options: AddAutoScalingGroupCapacityOptions = {}) {
     // clear the cache of the agent
     autoScalingGroup.addUserData('Remove-Item -Recurse C:\\ProgramData\\Amazon\\ECS\\Cache');

packages/aws-cdk-lib/aws-ecs/test/cluster.test.ts

@@ -1123,6 +1123,48 @@ describe('cluster', () => {
     });
   });
 
+  test('grantTaskProtection grants ecs:UpdateTaskProtection permission', () => {
+    // GIVEN
+    const stack = new cdk.Stack();
+    const vpc = new ec2.Vpc(stack, 'MyVpc', {});
+    const cluster = new ecs.Cluster(stack, 'EcsCluster', { vpc });
+    const role = new iam.Role(stack, 'TestRole', {
+      assumedBy: new iam.ServicePrincipal('ecs.amazonaws.com'),
+    });
+
+    // WHEN
+    cluster.grantTaskProtection(role);
+
+    // THEN
+    Template.fromStack(stack).hasResourceProperties('AWS::IAM::Policy', {
+      PolicyDocument: {
+        Statement: [
+          {
+            Action: 'ecs:UpdateTaskProtection',
+            Effect: 'Allow',
+            Resource: {
+              'Fn::Join': [
+                '',
+                [
+                  'arn:',
+                  { Ref: 'AWS::Partition' },
+                  ':ecs:',
+                  { Ref: 'AWS::Region' },
+                  ':',
+                  { Ref: 'AWS::AccountId' },
+                  ':task/',
+                  { Ref: 'EcsCluster97242B84' },
+                  '/*',
+                ],
+              ],
+            },
+          },
+        ],
+        Version: '2012-10-17',
+      },
+    });
+  });
+
   /*
    * TODO:v2.0.0 END OF OBSOLETE BLOCK
    */