feat(ecs): add managed storage configuration to Cluster and tests

[yasomaru]

Issue # (if applicable)

Closes #36499

Reason for this change

Description of changes

Expose managedStorageConfiguration property on the ICluster interface, following the same pattern as executeCommandConfiguration.

Changes:

• Add managedStorageConfiguration to ICluster interface
• Add managedStorageConfiguration to ClusterAttributes interface
• Add public getter to Cluster class
• Implement property in ImportedCluster class
• Add unit tests

Description of how you validated changes

• Added unit tests for both Cluster and ImportedCluster
• Ran npx tsc --noEmit - no type errors
• Ran npx jest -t "managedStorageConfiguration" - all tests pass

Checklist

• My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[aws-cdk-automation]

(This review is outdated)

✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.

[github-actions]

⚠️ Experimental Feature: This security report is currently in experimental phase. Results may include false positives and the rules are being actively refined.
Please try merge from main to avoid findings unrelated to the PR.

---

	Tests	Passed ✅	Skipped	Failed
Security Guardian Results	25 ran	25 passed

Test	Result
No test annotations available

• View Security Guardian Results

[github-actions]

⚠️ Experimental Feature: This security report is currently in experimental phase. Results may include false positives and the rules are being actively refined.
Please try merge from main to avoid findings unrelated to the PR.

---

	Tests	Passed ✅	Skipped	Failed
Security Guardian Results with resolved templates	25 ran	25 passed

Test	Result
No test annotations available

• View Security Guardian Results with resolved templates

[badmintoncryer]

Thank you for your contribution!!

I'm still unclear about the purpose of adding managedStorageConfiguration as an argument to fromAttributes().
In the case of executeCommandConfiguration, it's included as an argument because it's required by the permission-granting function in base-service.ts.

Is there a similar intention to add permission-granting functions for managedStorageConfiguration in the future?

Or is the goal simply to enable cross-stack references, instead of passing the KMS key directly, you pass the imported cluster and retrieve the KMS key from it? Is that the correct understanding?

[badmintoncryer]

This test is not executed in integ test normally. I think it is enough to remove these lines.

Suggested change

	// Verify that managedStorageConfiguration is accessible on imported cluster
	if (!importedCluster.managedStorageConfiguration) {
	throw new Error('managedStorageConfiguration should be defined on imported cluster');
	}

[yasomaru]

Thank you! Fixed.

[badmintoncryer]

The implementation itself seems good, so I'm planning to approve after understanding the background!

[yasomaru]

@badmintoncryer
Thank you for the review!

You're absolutely right about the similar pattern to executeCommandConfiguration. The primary purpose of adding managedStorageConfiguration to fromClusterAttributes() is to enable cross-stack references.

When users import a cluster from another stack, they may need to access the managed storage configuration, particularly the KMS key, for

• Granting proper permissions to tasks that use managed storage
• Ensuring consistent encryption settings across stacks
• Referencing the same KMS key without passing it separately

So yes, your understanding is correct: instead of passing the KMS key directly, users can pass the imported cluster and retrieve the KMS key from it via cluster.managedStorageConfiguration?.kmsKey.

While there's no immediate plan to add automatic permission-granting functions specifically for managedStorageConfiguration in base-service.ts, having this available in imported clusters provides the flexibility for users to manually grant necessary permissions if needed.

[badmintoncryer]

Thank you for your clarification!

[badmintoncryer]

I forgot to add a minor comment.

[badmintoncryer]

We can use interface of constructs.

Suggested change

	declare const vpc: ec2.Vpc;
	declare const key: kms.Key;
	declare const vpc: ec2.IVpc;
	declare const key: kms.IKey;