adam/afterhours-shift-manager
1
0
Fork 0
mirror of https://github.com/Sea-Haven-Industries/afterhours-shift-manager.git synced 2026-09-30 10:13:11 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

fix(infra): allow hcptf apply to create ECS and ELB service-linked roles (PLAT-216)

Browse source
This commit is contained in:
Adam Moussa 2026-09-21 18:49:25 -04:00
parent cbda46ba87
commit 92ca67e43c
No known key found for this signature in database
2 changed files with 14 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
terraform/hcp_iam.tf
View file

@ -634,6 +634,18 @@ data "aws_iam_policy_document" "hcptf_apply_ecs" {
resources = ["*"]
}
statement {
sid = "CreateElbAndEcsServiceLinkedRoles"
effect = "Allow"
actions = [
"iam:CreateServiceLinkedRole",
]
resources = [
"arn:aws:iam::${local.account_id}:role/aws-service-role/elasticloadbalancing.amazonaws.com/AWSServiceRoleForElasticLoadBalancing",
"arn:aws:iam::${local.account_id}:role/aws-service-role/ecs.amazonaws.com/AWSServiceRoleForECS",
]
}
statement {
sid = "EcrRepo"
effect = "Allow"

2
tests/infra/test_hcp_contract.py
View file

@ -79,6 +79,8 @@ def test_stack_owns_a_vpc_instead_of_looking_up_default():
assert 'resource "aws_iam_policy" "hcptf_apply_ecs"' in HCP_IAM
assert 'resource "aws_iam_role_policy" "hcptf_apply_ecs"' not in HCP_IAM
assert "aws_iam_policy.hcptf_apply_ecs.arn" in HCP_IAM
assert "sid = \"CreateElbAndEcsServiceLinkedRoles\"" in HCP_IAM
assert "iam:CreateServiceLinkedRole" in HCP_IAM
def test_ecs_task_boundary_uses_static_arns():