Hello there, I was wondering if that's possible to split the ecs Service provisioning from the TaskDefinition deployment update. My goal would be in a CD project to only have to update the task definition image tag without the permission to change anything else (which would be the responsibility of a separate provisioning project with dedicated permissions). Not sure that's possible given how the components are made and I didn't find anything relevant, so I'm trying to see if you guys already did something similar or would know how/if that's doable within pulumi ecosystem. Thanks !

I'm not too familiar with ECS but from reading the documentation it sounds like you can specify the task definition without its revision, leading to the latest (

ACTIVE

) version being used. Thus, you could update the task definition without changing the service.

Hum that's interesting, I overlooked the fact you can use the family:revision instead of the full arn. But not sure if I can create independently a new task and bind it to an existing service from a separate pulumi project

You can create the task in one project, export the ARN/tag, then create the service in a different project. Afterwards, you can modify the task definition in the first project.

Not sure either, but I'll try a few things you suggested. Thanks for having looked into it 🙏