aws-ecs: downscope permissions required by instance draining hook

[rix0rrr]

No description provided.

[rix0rrr]

Reference to source where downscoping should happen:

https://github.com/awslabs/aws-cdk/blob/master/packages/@aws-cdk/aws-ecs/lib/drain-hook/instance-drain-hook.ts#L76-L95

[SoManyHs]

@rix0rrr
In all of the managed ECS policies, the resource field for the actions specified in the above link are all "Resource": [*].

For the autoscaling permissions in particular, the required resource for CompleteLifecycleAction (according in the IAM docs ) is an autoscaling group, and if I'm understanding it, the policy won't work if the resource is not compatible with the required ones. All this to say, I think that the way the policy is defined in the Lambda should be fine, but feel free to clarify if I'm missing something.

[rix0rrr]

Probably: asg:CompleteLifeCycleAction will need ASG ARN? And the ecs calls need the ClusterArn?

Describe calls can stay at resource-* for all I care.

[piradeepk]

This can be resolved.