Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(ecs): ECS drain hook can't change instance state to draining #3198

Closed
Changes from 1 commit
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Next Next commit
fix(ecs): ECS drain hook can't change instance state to draining (#3190)
The UpdateContainerInstancesState permission was scoped to the ECS cluster
while it should be scoped to the container instance.

fixes #3190
ScOut3R committed Jul 4, 2019

Verified

This commit was created on GitHub.com and signed with GitHub’s verified signature.
commit caaee9eccbaa97783f0d86136322e9ce6df84df5
10 changes: 8 additions & 2 deletions packages/@aws-cdk/aws-ecs/lib/drain-hook/instance-drain-hook.ts
Original file line number Diff line number Diff line change
@@ -97,11 +97,17 @@ export class InstanceDrainHook extends cdk.Construct {
actions: [
'ecs:ListContainerInstances',
'ecs:SubmitContainerStateChange',
'ecs:SubmitTaskStateChange',
'ecs:SubmitTaskStateChange'
],
resources: [props.cluster.clusterArn]
}));

fn.addToRolePolicy(new iam.PolicyStatement({
actions: [
'ecs:UpdateContainerInstancesState',
'ecs:ListTasks'
],
resources: [props.cluster.clusterArn]
resources: [`arn:aws:ecs:${cdk.Aws.REGION}:${cdk.Aws.ACCOUNT_ID}:container-instance/*`]
}));
}
}