-
Notifications
You must be signed in to change notification settings - Fork 4k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
fix(eks): allow describe provisioning lamba to ec2:DescribeVpcs #10917
Conversation
Title does not follow the guidelines of Conventional Commits. Please adjust title before merge. |
The EKS provision lambda requires ec2:DescribeVpcs so that it can configure the EKS cluster in an existing VPC Signed-off-by: Dario Nascimento <dfrnascimento@gmail.com>
AWS CodeBuild CI Report
Powered by github-codebuild-logs, available on the AWS Serverless Application Repository |
@@ -141,6 +141,7 @@ export class ClusterResource extends CoreConstruct { | |||
actions: [ | |||
'ec2:DescribeSubnets', | |||
'ec2:DescribeRouteTables', | |||
'ec2:DescribeVpcs' |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The thing is that this already exists here:
aws-cdk/packages/@aws-cdk/aws-eks/lib/cluster-resource.ts
Lines 179 to 186 in fe6ec39
creationRole.addToPolicy(new iam.PolicyStatement({ | |
actions: ['ec2:DescribeVpcs'], | |
resources: [stack.formatArn({ | |
service: 'ec2', | |
resource: 'vpc', | |
resourceName: props.vpc.vpcId, | |
})], | |
})); |
However, this only grants it for the specific VPC its going to use. Why do we need permissions to describe ALL VPC's?
Also, did you add this because you hit the error described here? Im not sure this explains the sporadic behavior.
This PR has not received a response in a while. If you want to keep this issue open, please leave a comment below and auto-close will be canceled. |
Hello Guys,
Is there somebody from CDK team who can take a look at this? Thanks in advanced. |
How are we doing with this PR? |
I don't believe this error is caused by the fix proposed in this PR. See #9027 (comment). @dnascimento I'm closing this at the moment, please let me know if you still feel differently. |
The EKS provision lambda requires ec2:DescribeVpcs so that it can configure the EKS cluster in an existing VPC
Signed-off-by: Dario Nascimento dfrnascimento@gmail.com
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license