feat(apprunner): make Service implement IGrantable

packages/@aws-cdk/aws-apprunner-alpha/lib/service.ts

@@ -1140,6 +1140,17 @@ export class Service extends cdk.Resource {
     this.secrets.push({ name: name, value: secret.arn });
   }
 
+  /**
+   * This method exposes the Instance Role after creating it if not set.
+   * @returns iam.IRole
+   */
+  public obtainInstanceRole(): iam.IRole {
+    if (!this.instanceRole) {
+      this.instanceRole = this.createInstanceRole();
+    }
+    return this.instanceRole;
+  }
+
   /**
    * This method generates an Instance Role. Needed if using secrets and props.instanceRole is undefined
    * @returns iam.IRole

packages/@aws-cdk/aws-apprunner-alpha/test/service.test.ts

@@ -1252,4 +1252,23 @@ testDeprecated('Using both environmentVariables and environment should throw an
       }),
     });
   }).toThrow(/You cannot set both \'environmentVariables\' and \'environment\' properties./);
-});
+});
+
+test('Service exposes instanceRole via obtainInstanceRole()', () => {
+  // GIVEN
+  const app = new cdk.App();
+  const stack = new cdk.Stack(app, 'demo-stack');
+  // WHEN
+  const service = new apprunner.Service(stack, 'DemoService', {
+    source: apprunner.Source.fromEcrPublic({
+      imageIdentifier: 'public.ecr.aws/aws-containers/hello-app-runner:latest',
+    }),
+    instanceRole: new iam.Role(stack, 'InstanceRole', {
+      assumedBy: new iam.ServicePrincipal('tasks.apprunner.amazonaws.com'),
+    }),
+  });
+  // THEN
+  expect(stack.resolve(service.obtainInstanceRole().roleArn)).toEqual({
+    'Fn::GetAtt': ['InstanceRole3CCE2F1D', 'Arn'],
+  });
+});