Skip to content

Commit 9fbeec3

Browse files
ddneilsonddneilson
authored
fix(ecs): Scope-down IAM permissions for ECS drain (#9502)
Fixes #9501 ### Testing This was tested by deploying a simple app that was basically the sample from the ECS module readme, and then manually killing off instances from the ECS cluster's ASG. When I killed off an instance I then verified, from the lambda logs, that the task-draining lambda was able to complete its work with no errors. The essentials of the app are: ```ts const app = new cdk.App(); const env = { account: process.env.CDK_DEFAULT_ACCOUNT, region: process.env.CDK_DEFAULT_REGION } const stack = new cdk.Stack(app, 'Testing', { env }); const vpc = new ec2.Vpc(stack, 'Vpc'); // Create an ECS cluster const cluster = new ecs.Cluster(stack, 'Cluster', { vpc, }); // Add capacity to it cluster.addCapacity('DefaultAutoScalingGroupCapacity', { instanceType: new ec2.InstanceType("t2.xlarge"), desiredCapacity: 2, }); const taskDefinition = new ecs.Ec2TaskDefinition(stack, 'TaskDef'); taskDefinition.addContainer('DefaultContainer', { image: ecs.ContainerImage.fromRegistry("amazon/amazon-ecs-sample"), memoryLimitMiB: 512, logging: ecs.LogDriver.awsLogs({ logGroup: new logs.LogGroup(stack, 'LogGroup', { logGroupName: '/test-group/', removalPolicy: cdk.RemovalPolicy.DESTROY, retention: logs.RetentionDays.ONE_DAY, }), streamPrefix: 'testing-', }), }); // Instantiate an Amazon ECS Service const ecsService = new ecs.Ec2Service(stack, 'Service', { cluster, taskDefinition, desiredCount: 2, }); ``` ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
1 parent 76a7bfd commit 9fbeec3

15 files changed

+167
-14
lines changed

‎packages/@aws-cdk/aws-ecs-patterns/test/ec2/integ.multiple-application-load-balanced-ecs-service.expected.json

+11-1
Original file line numberDiff line numberDiff line change
@@ -658,7 +658,17 @@
658658
"ecs:DescribeTasks"
659659
],
660660
"Effect": "Allow",
661-
"Resource": "*"
661+
"Resource": "*",
662+
"Condition": {
663+
"ArnEquals": {
664+
"ecs:cluster": {
665+
"Fn::GetAtt": [
666+
"ClusterEB0386A7",
667+
"Arn"
668+
]
669+
}
670+
}
671+
}
662672
},
663673
{
664674
"Action": [

‎packages/@aws-cdk/aws-ecs-patterns/test/ec2/integ.scheduled-ecs-task.lit.expected.json

+11-1
Original file line numberDiff line numberDiff line change
@@ -474,7 +474,17 @@
474474
"ecs:DescribeTasks"
475475
],
476476
"Effect": "Allow",
477-
"Resource": "*"
477+
"Resource": "*",
478+
"Condition": {
479+
"ArnEquals": {
480+
"ecs:cluster": {
481+
"Fn::GetAtt": [
482+
"EcsCluster97242B84",
483+
"Arn"
484+
]
485+
}
486+
}
487+
}
478488
},
479489
{
480490
"Action": [

‎packages/@aws-cdk/aws-ecs/lib/drain-hook/instance-drain-hook.ts

+3
Original file line numberDiff line numberDiff line change
@@ -90,6 +90,9 @@ export class InstanceDrainHook extends cdk.Construct {
9090
fn.addToRolePolicy(new iam.PolicyStatement({
9191
actions: ['ecs:DescribeContainerInstances', 'ecs:DescribeTasks'],
9292
resources: ['*'],
93+
conditions: {
94+
ArnEquals: { 'ecs:cluster': props.cluster.clusterArn },
95+
},
9396
}));
9497

9598
// Restrict to the ECS Cluster

‎packages/@aws-cdk/aws-ecs/test/ec2/integ.app-mesh-proxy-config.expected.json

+11-1
Original file line numberDiff line numberDiff line change
@@ -637,7 +637,17 @@
637637
"ecs:DescribeTasks"
638638
],
639639
"Effect": "Allow",
640-
"Resource": "*"
640+
"Resource": "*",
641+
"Condition": {
642+
"ArnEquals": {
643+
"ecs:cluster": {
644+
"Fn::GetAtt": [
645+
"EcsCluster97242B84",
646+
"Arn"
647+
]
648+
}
649+
}
650+
}
641651
},
642652
{
643653
"Action": [

‎packages/@aws-cdk/aws-ecs/test/ec2/integ.clb-host-nw.expected.json

+11-1
Original file line numberDiff line numberDiff line change
@@ -658,7 +658,17 @@
658658
"ecs:DescribeTasks"
659659
],
660660
"Effect": "Allow",
661-
"Resource": "*"
661+
"Resource": "*",
662+
"Condition": {
663+
"ArnEquals": {
664+
"ecs:cluster": {
665+
"Fn::GetAtt": [
666+
"EcsCluster97242B84",
667+
"Arn"
668+
]
669+
}
670+
}
671+
}
662672
},
663673
{
664674
"Action": [

‎packages/@aws-cdk/aws-ecs/test/ec2/integ.firelens-s3-config.expected.json

+11-1
Original file line numberDiff line numberDiff line change
@@ -637,7 +637,17 @@
637637
"ecs:DescribeTasks"
638638
],
639639
"Effect": "Allow",
640-
"Resource": "*"
640+
"Resource": "*",
641+
"Condition": {
642+
"ArnEquals": {
643+
"ecs:cluster": {
644+
"Fn::GetAtt": [
645+
"EcsCluster97242B84",
646+
"Arn"
647+
]
648+
}
649+
}
650+
}
641651
},
642652
{
643653
"Action": [

‎packages/@aws-cdk/aws-ecs/test/ec2/integ.lb-awsvpc-nw.expected.json

+11-1
Original file line numberDiff line numberDiff line change
@@ -637,7 +637,17 @@
637637
"ecs:DescribeTasks"
638638
],
639639
"Effect": "Allow",
640-
"Resource": "*"
640+
"Resource": "*",
641+
"Condition": {
642+
"ArnEquals": {
643+
"ecs:cluster": {
644+
"Fn::GetAtt": [
645+
"EcsCluster97242B84",
646+
"Arn"
647+
]
648+
}
649+
}
650+
}
641651
},
642652
{
643653
"Action": [

‎packages/@aws-cdk/aws-ecs/test/ec2/integ.lb-bridge-nw.expected.json

+11-1
Original file line numberDiff line numberDiff line change
@@ -658,7 +658,17 @@
658658
"ecs:DescribeTasks"
659659
],
660660
"Effect": "Allow",
661-
"Resource": "*"
661+
"Resource": "*",
662+
"Condition": {
663+
"ArnEquals": {
664+
"ecs:cluster": {
665+
"Fn::GetAtt": [
666+
"EcsCluster97242B84",
667+
"Arn"
668+
]
669+
}
670+
}
671+
}
662672
},
663673
{
664674
"Action": [

‎packages/@aws-cdk/aws-ecs/test/ec2/integ.sd-awsvpc-nw.expected.json

+11-1
Original file line numberDiff line numberDiff line change
@@ -637,7 +637,17 @@
637637
"ecs:DescribeTasks"
638638
],
639639
"Effect": "Allow",
640-
"Resource": "*"
640+
"Resource": "*",
641+
"Condition": {
642+
"ArnEquals": {
643+
"ecs:cluster": {
644+
"Fn::GetAtt": [
645+
"EcsCluster97242B84",
646+
"Arn"
647+
]
648+
}
649+
}
650+
}
641651
},
642652
{
643653
"Action": [

‎packages/@aws-cdk/aws-ecs/test/ec2/integ.sd-bridge-nw.expected.json

+11-1
Original file line numberDiff line numberDiff line change
@@ -637,7 +637,17 @@
637637
"ecs:DescribeTasks"
638638
],
639639
"Effect": "Allow",
640-
"Resource": "*"
640+
"Resource": "*",
641+
"Condition": {
642+
"ArnEquals": {
643+
"ecs:cluster": {
644+
"Fn::GetAtt": [
645+
"EcsCluster97242B84",
646+
"Arn"
647+
]
648+
}
649+
}
650+
}
641651
},
642652
{
643653
"Action": [

‎packages/@aws-cdk/aws-ecs/test/ec2/integ.spot-drain.expected.json

+22-2
Original file line numberDiff line numberDiff line change
@@ -639,7 +639,17 @@
639639
"ecs:DescribeTasks"
640640
],
641641
"Effect": "Allow",
642-
"Resource": "*"
642+
"Resource": "*",
643+
"Condition": {
644+
"ArnEquals": {
645+
"ecs:cluster": {
646+
"Fn::GetAtt": [
647+
"EcsCluster97242B84",
648+
"Arn"
649+
]
650+
}
651+
}
652+
}
643653
},
644654
{
645655
"Action": [
@@ -1110,7 +1120,17 @@
11101120
"ecs:DescribeTasks"
11111121
],
11121122
"Effect": "Allow",
1113-
"Resource": "*"
1123+
"Resource": "*",
1124+
"Condition": {
1125+
"ArnEquals": {
1126+
"ecs:cluster": {
1127+
"Fn::GetAtt": [
1128+
"EcsCluster97242B84",
1129+
"Arn"
1130+
]
1131+
}
1132+
}
1133+
}
11141134
},
11151135
{
11161136
"Action": [

‎packages/@aws-cdk/aws-ecs/test/test.ecs-cluster.ts

+10
Original file line numberDiff line numberDiff line change
@@ -444,6 +444,16 @@ export = {
444444
],
445445
Effect: 'Allow',
446446
Resource: '*',
447+
Condition: {
448+
ArnEquals: {
449+
'ecs:cluster': {
450+
'Fn::GetAtt': [
451+
'EcsCluster97242B84',
452+
'Arn',
453+
],
454+
},
455+
},
456+
},
447457
},
448458
{
449459
Action: [

‎packages/@aws-cdk/aws-events-targets/test/ecs/integ.event-ec2-task.lit.expected.json

+11-1
Original file line numberDiff line numberDiff line change
@@ -475,7 +475,17 @@
475475
"ecs:DescribeTasks"
476476
],
477477
"Effect": "Allow",
478-
"Resource": "*"
478+
"Resource": "*",
479+
"Condition": {
480+
"ArnEquals": {
481+
"ecs:cluster": {
482+
"Fn::GetAtt": [
483+
"EcsCluster97242B84",
484+
"Arn"
485+
]
486+
}
487+
}
488+
}
479489
},
480490
{
481491
"Action": [

‎packages/@aws-cdk/aws-stepfunctions-tasks/test/ecs/integ.ec2-run-task.expected.json

+11-1
Original file line numberDiff line numberDiff line change
@@ -269,7 +269,17 @@
269269
"ecs:DescribeTasks"
270270
],
271271
"Effect": "Allow",
272-
"Resource": "*"
272+
"Resource": "*",
273+
"Condition": {
274+
"ArnEquals": {
275+
"ecs:cluster": {
276+
"Fn::GetAtt": [
277+
"Ec2ClusterEE43E89D",
278+
"Arn"
279+
]
280+
}
281+
}
282+
}
273283
},
274284
{
275285
"Action": [

‎packages/@aws-cdk/aws-stepfunctions-tasks/test/ecs/integ.ec2-task.expected.json

+11-1
Original file line numberDiff line numberDiff line change
@@ -269,7 +269,17 @@
269269
"ecs:DescribeTasks"
270270
],
271271
"Effect": "Allow",
272-
"Resource": "*"
272+
"Resource": "*",
273+
"Condition": {
274+
"ArnEquals": {
275+
"ecs:cluster": {
276+
"Fn::GetAtt": [
277+
"FargateCluster7CCD5F93",
278+
"Arn"
279+
]
280+
}
281+
}
282+
}
273283
},
274284
{
275285
"Action": [

0 commit comments

Comments
 (0)