Skip to content

Commit

Permalink
fix(ecs): grant instance drain-hook policy container-instance permiss…
Browse files Browse the repository at this point in the history
…ions

UpdateContainerInstanceState and ListTask APIs require permissions on
a container-instance resource, rather than a cluster resource. This
change updates the policy to:

1. remove the cluster as the resource restriction
2. add the cluster as a resource condition

More info on ECS Resource-Level permissions can be found here:
https://docs.aws.amazon.com/AmazonECS/latest/developerguide/ecs-supported-iam-actions-resources.html

Fixes aws#3190
  • Loading branch information
CodePipeline-Test committed Jul 4, 2019
1 parent 3a9fa64 commit eb126ba
Show file tree
Hide file tree
Showing 7 changed files with 140 additions and 34 deletions.
16 changes: 13 additions & 3 deletions packages/@aws-cdk/aws-ecs/lib/drain-hook/instance-drain-hook.ts
Original file line number Diff line number Diff line change
Expand Up @@ -97,11 +97,21 @@ export class InstanceDrainHook extends cdk.Construct {
actions: [
'ecs:ListContainerInstances',
'ecs:SubmitContainerStateChange',
'ecs:SubmitTaskStateChange',
'ecs:UpdateContainerInstancesState',
'ecs:ListTasks'
'ecs:SubmitTaskStateChange'
],
resources: [props.cluster.clusterArn]
}));

// Restrict to the container-instance operations to the ECS Cluster
fn.addToRolePolicy(new iam.PolicyStatement({
actions: [
'ecs:UpdateContainerInstancesState',
'ecs:ListTasks'
],
conditions: {
ArnEquals: {'ecs:cluster': props.cluster.clusterArn}
},
resources: ['*']
}));
}
}
Original file line number Diff line number Diff line change
Expand Up @@ -605,9 +605,7 @@
"Action": [
"ecs:ListContainerInstances",
"ecs:SubmitContainerStateChange",
"ecs:SubmitTaskStateChange",
"ecs:UpdateContainerInstancesState",
"ecs:ListTasks"
"ecs:SubmitTaskStateChange"
],
"Effect": "Allow",
"Resource": {
Expand All @@ -616,6 +614,24 @@
"Arn"
]
}
},
{
"Action": [
"ecs:UpdateContainerInstancesState",
"ecs:ListTasks"
],
"Condition": {
"ArnEquals": {
"ecs:cluster": {
"Fn::GetAtt": [
"EcsCluster97242B84",
"Arn"
]
}
}
},
"Effect": "Allow",
"Resource": "*"
}
],
"Version": "2012-10-17"
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -626,9 +626,7 @@
"Action": [
"ecs:ListContainerInstances",
"ecs:SubmitContainerStateChange",
"ecs:SubmitTaskStateChange",
"ecs:UpdateContainerInstancesState",
"ecs:ListTasks"
"ecs:SubmitTaskStateChange"
],
"Effect": "Allow",
"Resource": {
Expand All @@ -637,6 +635,24 @@
"Arn"
]
}
},
{
"Action": [
"ecs:UpdateContainerInstancesState",
"ecs:ListTasks"
],
"Condition": {
"ArnEquals": {
"ecs:cluster": {
"Fn::GetAtt": [
"EcsCluster97242B84",
"Arn"
]
}
}
},
"Effect": "Allow",
"Resource": "*"
}
],
"Version": "2012-10-17"
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -605,9 +605,7 @@
"Action": [
"ecs:ListContainerInstances",
"ecs:SubmitContainerStateChange",
"ecs:SubmitTaskStateChange",
"ecs:UpdateContainerInstancesState",
"ecs:ListTasks"
"ecs:SubmitTaskStateChange"
],
"Effect": "Allow",
"Resource": {
Expand All @@ -616,6 +614,24 @@
"Arn"
]
}
},
{
"Action": [
"ecs:UpdateContainerInstancesState",
"ecs:ListTasks"
],
"Condition": {
"ArnEquals": {
"ecs:cluster": {
"Fn::GetAtt": [
"EcsCluster97242B84",
"Arn"
]
}
}
},
"Effect": "Allow",
"Resource": "*"
}
],
"Version": "2012-10-17"
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -605,9 +605,7 @@
"Action": [
"ecs:ListContainerInstances",
"ecs:SubmitContainerStateChange",
"ecs:SubmitTaskStateChange",
"ecs:UpdateContainerInstancesState",
"ecs:ListTasks"
"ecs:SubmitTaskStateChange"
],
"Effect": "Allow",
"Resource": {
Expand All @@ -616,6 +614,24 @@
"Arn"
]
}
},
{
"Action": [
"ecs:UpdateContainerInstancesState",
"ecs:ListTasks"
],
"Condition": {
"ArnEquals": {
"ecs:cluster": {
"Fn::GetAtt": [
"EcsCluster97242B84",
"Arn"
]
}
}
},
"Effect": "Allow",
"Resource": "*"
}
],
"Version": "2012-10-17"
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -446,21 +446,37 @@
"Resource": "*"
},
{
"Action": [
"ecs:ListContainerInstances",
"ecs:SubmitContainerStateChange",
"ecs:SubmitTaskStateChange",
"ecs:UpdateContainerInstancesState",
"ecs:ListTasks"
],
"Effect": "Allow",
"Resource": {
"Fn::GetAtt": [
"EcsCluster97242B84",
"Arn"
]
"Action": [
"ecs:ListContainerInstances",
"ecs:SubmitContainerStateChange",
"ecs:SubmitTaskStateChange"
],
"Effect": "Allow",
"Resource": {
"Fn::GetAtt": [
"EcsCluster97242B84",
"Arn"
]
}
},
{
"Action": [
"ecs:UpdateContainerInstancesState",
"ecs:ListTasks"
],
"Condition": {
"ArnEquals": {
"ecs:cluster": {
"Fn::GetAtt": [
"EcsCluster97242B84",
"Arn"
]
}
}
},
"Effect": "Allow",
"Resource": "*"
}
}
],
"Version": "2012-10-17"
},
Expand Down Expand Up @@ -1197,4 +1213,4 @@
"Description": "Artifact hash for asset \"aws-ecs-integ-ecs/AdoptEcrRepositorydbc60defc59544bcaa5c28c95d68f62c/Code\""
}
}
}
}
Original file line number Diff line number Diff line change
Expand Up @@ -249,9 +249,7 @@
"Action": [
"ecs:ListContainerInstances",
"ecs:SubmitContainerStateChange",
"ecs:SubmitTaskStateChange",
"ecs:UpdateContainerInstancesState",
"ecs:ListTasks"
"ecs:SubmitTaskStateChange"
],
"Effect": "Allow",
"Resource": {
Expand All @@ -260,6 +258,24 @@
"Arn"
]
}
},
{
"Action": [
"ecs:UpdateContainerInstancesState",
"ecs:ListTasks"
],
"Condition": {
"ArnEquals": {
"ecs:cluster": {
"Fn::GetAtt": [
"FargateCluster7CCD5F93",
"Arn"
]
}
}
},
"Effect": "Allow",
"Resource": "*"
}
],
"Version": "2012-10-17"
Expand Down Expand Up @@ -978,4 +994,4 @@
"Description": "Artifact hash for asset \"aws-ecs-integ2/AdoptEcrRepositorydbc60defc59544bcaa5c28c95d68f62c/Code\""
}
}
}
}

0 comments on commit eb126ba

Please sign in to comment.