Downscope permissions required by instance draining hook

aws · Jun 7, 2019 · 5c3047a · 5c3047a
1 parent e4fb811
commit 5c3047a
Show file tree

Hide file tree

Showing 5 changed files with 103 additions and 25 deletions.
diff --git a/packages/@aws-cdk/aws-ecs/lib/drain-hook/instance-drain-hook.ts b/packages/@aws-cdk/aws-ecs/lib/drain-hook/instance-drain-hook.ts
@@ -73,25 +73,35 @@ export class InstanceDrainHook extends cdk.Construct {
     // know how.
     fn.addToRolePolicy(new iam.PolicyStatement()
       .addActions(
-        'autoscaling:CompleteLifecycleAction',
         'ec2:DescribeInstances',
         'ec2:DescribeInstanceAttribute',
         'ec2:DescribeInstanceStatus',
-        'ec2:DescribeHosts',
+        'ec2:DescribeHosts'
       )
       .addAllResources());
 
-    // FIXME: These should be restricted to the ECS cluster probably, but I don't exactly
-    // know how.
+    fn.addToRolePolicy(new iam.PolicyStatement()
+      .addActions(
+        'autoscaling:CompleteLifecycleAction'
+      )
+      .addResource(props.autoScalingGroup.autoScalingGroupName));
+
+    fn.addToRolePolicy(new iam.PolicyStatement()
+      .addActions(
+        'ecs:DescribeContainerInstances',
+        'ecs:DescribeTasks'
+      )
+      .addAllResources());
+
+    // Restricted to use the following ecs actions on the cluster
     fn.addToRolePolicy(new iam.PolicyStatement()
       .addActions(
         'ecs:ListContainerInstances',
+        'ecs:ListTasks',
         'ecs:SubmitContainerStateChange',
         'ecs:SubmitTaskStateChange',
-        'ecs:DescribeContainerInstances',
-        'ecs:UpdateContainerInstancesState',
-        'ecs:ListTasks',
-        'ecs:DescribeTasks')
-      .addAllResources());
+        'ecs:UpdateContainerInstancesState'
+      )
+      .addResource(props.cluster.clusterArn));
   }
 }
diff --git a/packages/@aws-cdk/aws-ecs/test/ec2/integ.lb-awsvpc-nw.expected.json b/packages/@aws-cdk/aws-ecs/test/ec2/integ.lb-awsvpc-nw.expected.json
@@ -559,7 +559,6 @@
           "Statement": [
             {
               "Action": [
-                "autoscaling:CompleteLifecycleAction",
                 "ec2:DescribeInstances",
                 "ec2:DescribeInstanceAttribute",
                 "ec2:DescribeInstanceStatus",
@@ -568,18 +567,36 @@
               "Effect": "Allow",
               "Resource": "*"
             },
+            {
+              "Action": "autoscaling:CompleteLifecycleAction",
+              "Effect": "Allow",
+              "Resource": {
+                "Ref": "EcsClusterDefaultAutoScalingGroupASGC1A785DB"
+              }
+            },
             {
               "Action": [
-                "ecs:ListContainerInstances",
                 "ecs:SubmitContainerStateChange",
                 "ecs:SubmitTaskStateChange",
                 "ecs:DescribeContainerInstances",
-                "ecs:UpdateContainerInstancesState",
-                "ecs:ListTasks",
                 "ecs:DescribeTasks"
               ],
               "Effect": "Allow",
               "Resource": "*"
+            },
+            {
+              "Action": [
+                "ecs:ListContainerInstances",
+                "ecs:ListTasks",
+                "ecs:UpdateContainerInstancesState"              
+              ],
+              "Effect": "Allow",
+              "Resource": {
+                "Fn::GetAtt": [
+                  "EcsCluster97242B84",
+                  "Arn"
+                ]
+              }
             }
           ],
           "Version": "2012-10-17"

diff --git a/packages/@aws-cdk/aws-ecs/test/ec2/integ.lb-bridge-nw.expected.json b/packages/@aws-cdk/aws-ecs/test/ec2/integ.lb-bridge-nw.expected.json
@@ -580,7 +580,6 @@
           "Statement": [
             {
               "Action": [
-                "autoscaling:CompleteLifecycleAction",
                 "ec2:DescribeInstances",
                 "ec2:DescribeInstanceAttribute",
                 "ec2:DescribeInstanceStatus",
@@ -589,18 +588,36 @@
               "Effect": "Allow",
               "Resource": "*"
             },
+            {
+              "Action": "autoscaling:CompleteLifecycleAction",
+              "Effect": "Allow",
+              "Resource": {
+                "Ref": "EcsClusterDefaultAutoScalingGroupASGC1A785DB"
+              }
+            },
             {
               "Action": [
-                "ecs:ListContainerInstances",
                 "ecs:SubmitContainerStateChange",
                 "ecs:SubmitTaskStateChange",
                 "ecs:DescribeContainerInstances",
-                "ecs:UpdateContainerInstancesState",
-                "ecs:ListTasks",
                 "ecs:DescribeTasks"
               ],
               "Effect": "Allow",
               "Resource": "*"
+            },
+            {
+              "Action": [
+                "ecs:ListContainerInstances",
+                "ecs:ListTasks",
+                "ecs:UpdateContainerInstancesState"              
+              ],
+              "Effect": "Allow",
+              "Resource": {
+                "Fn::GetAtt": [
+                  "EcsCluster97242B84",
+                  "Arn"
+                ]
+              }
             }
           ],
           "Version": "2012-10-17"

diff --git a/packages/@aws-cdk/aws-ecs/test/ec2/integ.sd-awsvpc-nw.expected.json b/packages/@aws-cdk/aws-ecs/test/ec2/integ.sd-awsvpc-nw.expected.json
@@ -559,7 +559,6 @@
           "Statement": [
             {
               "Action": [
-                "autoscaling:CompleteLifecycleAction",
                 "ec2:DescribeInstances",
                 "ec2:DescribeInstanceAttribute",
                 "ec2:DescribeInstanceStatus",
@@ -568,18 +567,36 @@
               "Effect": "Allow",
               "Resource": "*"
             },
+            {
+              "Action": "autoscaling:CompleteLifecycleAction",
+              "Effect": "Allow",
+              "Resource": {
+                "Ref": "EcsClusterDefaultAutoScalingGroupASGC1A785DB"
+              }
+            },
             {
               "Action": [
-                "ecs:ListContainerInstances",
                 "ecs:SubmitContainerStateChange",
                 "ecs:SubmitTaskStateChange",
                 "ecs:DescribeContainerInstances",
-                "ecs:UpdateContainerInstancesState",
-                "ecs:ListTasks",
                 "ecs:DescribeTasks"
               ],
               "Effect": "Allow",
               "Resource": "*"
+            },
+            {
+              "Action": [
+                "ecs:ListContainerInstances",
+                "ecs:ListTasks",
+                "ecs:UpdateContainerInstancesState"              
+              ],
+              "Effect": "Allow",
+              "Resource": {
+                "Fn::GetAtt": [
+                  "EcsCluster97242B84",
+                  "Arn"
+                ]
+              }
             }
           ],
           "Version": "2012-10-17"

diff --git a/packages/@aws-cdk/aws-ecs/test/ec2/integ.sd-bridge-nw.expected.json b/packages/@aws-cdk/aws-ecs/test/ec2/integ.sd-bridge-nw.expected.json
@@ -559,7 +559,6 @@
           "Statement": [
             {
               "Action": [
-                "autoscaling:CompleteLifecycleAction",
                 "ec2:DescribeInstances",
                 "ec2:DescribeInstanceAttribute",
                 "ec2:DescribeInstanceStatus",
@@ -568,18 +567,36 @@
               "Effect": "Allow",
               "Resource": "*"
             },
+            {
+              "Action": "autoscaling:CompleteLifecycleAction",
+              "Effect": "Allow",
+              "Resource": {
+                "Ref": "EcsClusterDefaultAutoScalingGroupASGC1A785DB"
+              }
+            },
             {
               "Action": [
-                "ecs:ListContainerInstances",
                 "ecs:SubmitContainerStateChange",
                 "ecs:SubmitTaskStateChange",
                 "ecs:DescribeContainerInstances",
-                "ecs:UpdateContainerInstancesState",
-                "ecs:ListTasks",
                 "ecs:DescribeTasks"
               ],
               "Effect": "Allow",
               "Resource": "*"
+            },
+            {
+              "Action": [
+                "ecs:ListContainerInstances",
+                "ecs:ListTasks",
+                "ecs:UpdateContainerInstancesState"              
+              ],
+              "Effect": "Allow",
+              "Resource": {
+                "Fn::GetAtt": [
+                  "EcsCluster97242B84",
+                  "Arn"
+                ]
+              }
             }
           ],
           "Version": "2012-10-17"