fix(aws-ecs): downscope permissions required by instance draining hook

[piradeepk]

PR to address issue #1204.

• Constructed the ASG arn to accept any autoScalingGroup as long as the asg name is the same
  "arn:aws:autoscaling:us-east-2:123456789012:autoScalingGroup:*:autoScalingGroupName/group-name"
• https://docs.aws.amazon.com/autoscaling/ec2/userguide/control-access-using-iam.html

---

Pull Request Checklist

• Testing
  • Unit test added (prefer not to modify an existing test, otherwise, it's probably a breaking change)
  • CLI change?: coordinate update of integration tests with team
  • cdk-init template change?: coordinated update of integration tests with team
• Docs
  • jsdocs: All public APIs documented
  • README: README and/or documentation topic updated
  • Design: For significant features, design document added to design folder
• Title and Description
  • Change type: title prefixed with fix, feat and module name in parens, which will appear in changelog
  • Title: use lower-case and doesn't end with a period
  • Breaking?: last paragraph: "BREAKING CHANGE: <describe what changed + link for details>"
  • Issues: Indicate issues fixed via: "Fixes #xxx" or "Closes #xxx"
• Sensitive Modules (requires 2 PR approvers)
  • IAM Policy Document (in @aws-cdk/aws-iam)
  • EC2 Security Groups and ACLs (in @aws-cdk/aws-ec2)
  • Grant APIs (only if not based on official documentation with a reference)

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license.

[rix0rrr]

'ecs:SubmitContainerStateChange' and 'ecs:SubmitTaskStateChange' are only actions that can be performed by ECS Agent and as such do not see a need in restricting them.

What does it mean, "can only be performed by ECS Agent"? Can I not take the SDK and make the same call? If the SDK does not have it, can I not take curl and make the same call? If I did, what would be the effect?

If you feel very secure in this reasoning, put it in the code as well please (in a comment) so the reasoning will be easily discovered later.

[piradeepk]

'ecs:SubmitContainerStateChange' and 'ecs:SubmitTaskStateChange' are only actions that can be performed by ECS Agent and as such do not see a need in restricting them.

What does it mean, "can only be performed by ECS Agent"? Can I not take the SDK and make the same call? If the SDK does not have it, can I not take curl and make the same call? If I did, what would be the effect?

If you feel very secure in this reasoning, put it in the code as well please (in a comment) so the reasoning will be easily discovered later.

After further offline discussions, 'ecs:SubmitContainerStateChange' and 'ecs:SubmitTaskStateChange' have been restricted to the cluster.

[rix0rrr]

Thanks for the hard work Piradeep!