Fix how we add perms together

Author: ryanjjung

tb_pulumi/fargate.py

@@ -91,9 +91,9 @@ class AutoscalingFargateCluster(tb_pulumi.ThunderbirdComponentResource):
       the only valid source. Defaults to {}.
     :type container_security_groups: _type_, optional
 
-    :param exec_role_policies: A dict where the keys are the names of services and the values are lists of ARNs of IAM
-      Policies that service should operate with. These should provide permissions above and beyond what is provided by
-      using the ``registries``, ``secrets``, and ``ssm_params`` parameters.
+    :param extra_policies: A dict where the keys are the names of services and the values are lists of ARNs of IAM
+      Policies that service should operate with in addition to what is provided by using the ``registries``,
+      ``secrets``, and ``ssm_params`` parameters.
 
     :param listeners: A nested dict describing your load balancers' listeners and which targets they point to. At the
       top level, the keys are names of load balancers and the values are other dicts. Those dicts' keys are the names of
@@ -173,7 +173,7 @@ def __init__(
         cluster: dict = {},
         cluster_name: str = None,
         container_security_groups: dict[str:dict] = {},
-        exec_role_policies: dict[str:list] = {},
+        extra_policies: dict[str:list] = {},
         listeners: dict[str, dict] = {},
         load_balancer_security_groups: dict[str, dict] = {},
         load_balancers: dict = {},
@@ -272,7 +272,6 @@ def __init__(
                 f'{name}-execrolepolicy-{service}',
                 name=f'{name}-{service}',
                 description=f'Grants permissions needed to launch the {service} service for {self.project.name_prefix}',
-                managed_policy_arns=exec_role_policies.get(service),
                 policy=exec_role_policy_docs[service],
                 opts=pulumi.ResourceOptions(parent=self),
                 tags=self.tags,
@@ -281,21 +280,30 @@ def __init__(
         }
 
         # Build the execution roles using the policies from above, if they exist
-        exec_roles = {
-            service: aws.iam.Role(
+        _universal_managed_policy_arns = [
+            # This AWS managed policy allows access to ECR and log streams
+            'arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy',
+        ]
+
+        exec_roles = {}
+
+        for service in services.keys():
+            _managed_policy_arns = _universal_managed_policy_arns.copy()
+            _managed_policy_arns += [
+                item
+                for item in [
+                    exec_role_policies[service] if service in exec_role_policies else None,
+                ]
+                if item is not None
+            ]
+            _managed_policy_arns += extra_policies.get(service, [])
+
+            exec_roles[service] = aws.iam.Role(
                 f'{name}-execrole-{service}',
                 name=f'{name}-{service}',
                 description=f'Task execution role for running the {service} service for {self.project.name_prefix}',
                 assume_role_policy=arp,
-                managed_policy_arns=[
-                    item
-                    for item in [
-                        # This AWS managed policy allows access to ECR and log streams
-                        'arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy',
-                        exec_role_policies[service] if service in exec_role_policies else None,
-                    ]
-                    if item is not None
-                ],
+                managed_policy_arns=_universal_managed_policy_arns + exec_role_policies.get('service', []),
                 tags=self.tags,
                 opts=pulumi.ResourceOptions(
                     parent=self,
@@ -306,8 +314,6 @@ def __init__(
                     ],
                 ),
             )
-            for service in services.keys()
-        }
 
         # First we build out task definitions. Later, we can refer to them by name. Since task definitions are
         # one-to-one with cluster services, the task_name here is assumed to match with a service name.