Skip to content

Commit

Permalink
Downscope permissions required by instance draining hook
Browse files Browse the repository at this point in the history
  • Loading branch information
piradeepk committed Jun 5, 2019
1 parent b2e1964 commit 8abbb8b
Show file tree
Hide file tree
Showing 5 changed files with 74 additions and 20 deletions.
26 changes: 18 additions & 8 deletions packages/@aws-cdk/aws-ecs/lib/drain-hook/instance-drain-hook.ts
Original file line number Diff line number Diff line change
Expand Up @@ -73,25 +73,35 @@ export class InstanceDrainHook extends cdk.Construct {
// know how.
fn.addToRolePolicy(new iam.PolicyStatement()
.addActions(
'autoscaling:CompleteLifecycleAction',
'ec2:DescribeInstances',
'ec2:DescribeInstanceAttribute',
'ec2:DescribeInstanceStatus',
'ec2:DescribeHosts',
'ec2:DescribeHosts'
)
.addAllResources());

// FIXME: These should be restricted to the ECS cluster probably, but I don't exactly
// know how.
fn.addToRolePolicy(new iam.PolicyStatement()
.addActions(
'ecs:ListContainerInstances',
'autoscaling:CompleteLifecycleAction'
)
.addResource(props.autoScalingGroup.autoScalingGroupName));

fn.addToRolePolicy(new iam.PolicyStatement()
.addActions(
'ecs:SubmitContainerStateChange',
'ecs:SubmitTaskStateChange',
'ecs:DescribeContainerInstances',
'ecs:UpdateContainerInstancesState',
'ecs:ListTasks',
'ecs:DescribeTasks')
'ecs:DescribeTasks'
)
.addAllResources());

// Restricted to use the following ecs actions on the cluster
fn.addToRolePolicy(new iam.PolicyStatement()
.addActions(
'ecs:ListContainerInstances',
'ecs:ListTasks',
'ecs:UpdateContainerInstancesState'
)
.addResource(props.cluster.clusterArn));
}
}
Original file line number Diff line number Diff line change
Expand Up @@ -570,16 +570,27 @@
},
{
"Action": [
"ecs:ListContainerInstances",
"ecs:SubmitContainerStateChange",
"ecs:SubmitTaskStateChange",
"ecs:DescribeContainerInstances",
"ecs:UpdateContainerInstancesState",
"ecs:ListTasks",
"ecs:DescribeTasks"
],
"Effect": "Allow",
"Resource": "*"
},
{
"Action": [
"ecs:ListContainerInstances",
"ecs:ListTasks",
"ecs:UpdateContainerInstancesState"
],
"Effect": "Allow",
"Resource": {
"Fn::GetAtt": [
"EcsCluster97242B84",
"Arn"
]
}
}
],
"Version": "2012-10-17"
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -591,16 +591,27 @@
},
{
"Action": [
"ecs:ListContainerInstances",
"ecs:SubmitContainerStateChange",
"ecs:SubmitTaskStateChange",
"ecs:DescribeContainerInstances",
"ecs:UpdateContainerInstancesState",
"ecs:ListTasks",
"ecs:DescribeTasks"
],
"Effect": "Allow",
"Resource": "*"
},
{
"Action": [
"ecs:ListContainerInstances",
"ecs:ListTasks",
"ecs:UpdateContainerInstancesState"
],
"Effect": "Allow",
"Resource": {
"Fn::GetAtt": [
"EcsCluster97242B84",
"Arn"
]
}
}
],
"Version": "2012-10-17"
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -570,16 +570,27 @@
},
{
"Action": [
"ecs:ListContainerInstances",
"ecs:SubmitContainerStateChange",
"ecs:SubmitTaskStateChange",
"ecs:DescribeContainerInstances",
"ecs:UpdateContainerInstancesState",
"ecs:ListTasks",
"ecs:DescribeTasks"
],
"Effect": "Allow",
"Resource": "*"
},
{
"Action": [
"ecs:ListContainerInstances",
"ecs:ListTasks",
"ecs:UpdateContainerInstancesState"
],
"Effect": "Allow",
"Resource": {
"Fn::GetAtt": [
"EcsCluster97242B84",
"Arn"
]
}
}
],
"Version": "2012-10-17"
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -570,16 +570,27 @@
},
{
"Action": [
"ecs:ListContainerInstances",
"ecs:SubmitContainerStateChange",
"ecs:SubmitTaskStateChange",
"ecs:DescribeContainerInstances",
"ecs:UpdateContainerInstancesState",
"ecs:ListTasks",
"ecs:DescribeTasks"
],
"Effect": "Allow",
"Resource": "*"
},
{
"Action": [
"ecs:ListContainerInstances",
"ecs:ListTasks",
"ecs:UpdateContainerInstancesState"
],
"Effect": "Allow",
"Resource": {
"Fn::GetAtt": [
"EcsCluster97242B84",
"Arn"
]
}
}
],
"Version": "2012-10-17"
Expand Down

0 comments on commit 8abbb8b

Please sign in to comment.