adam/afterhours-shift-manager
1
0
Fork 0
mirror of https://github.com/Sea-Haven-Industries/afterhours-shift-manager.git synced 2026-09-30 06:43:12 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

fix(infra): allow hcptf apply to create ECS and ELB service-linked roles (PLAT-216) (#265)

Browse source
This commit is contained in:
Adam Moussa 2026-09-21 22:56:09 +00:00 • committed by GitHub
parent cbda46ba87
commit be1160192c
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 14 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
terraform/hcp_iam.tf
View file

@ -634,6 +634,18 @@ data "aws_iam_policy_document" "hcptf_apply_ecs" {
resources = ["*"]
}
statement {
sid = "CreateElbAndEcsServiceLinkedRoles"
effect = "Allow"
actions = [
"iam:CreateServiceLinkedRole",
]
resources = [
"arn:aws:iam::${local.account_id}:role/aws-service-role/elasticloadbalancing.amazonaws.com/AWSServiceRoleForElasticLoadBalancing",
"arn:aws:iam::${local.account_id}:role/aws-service-role/ecs.amazonaws.com/AWSServiceRoleForECS",
]
}
statement {
sid = "EcrRepo"
effect = "Allow"

2
tests/infra/test_hcp_contract.py
View file

@ -79,6 +79,8 @@ def test_stack_owns_a_vpc_instead_of_looking_up_default():
assert 'resource "aws_iam_policy" "hcptf_apply_ecs"' in HCP_IAM
assert 'resource "aws_iam_role_policy" "hcptf_apply_ecs"' not in HCP_IAM
assert "aws_iam_policy.hcptf_apply_ecs.arn" in HCP_IAM
assert "sid = \"CreateElbAndEcsServiceLinkedRoles\"" in HCP_IAM
assert "iam:CreateServiceLinkedRole" in HCP_IAM
def test_ecs_task_boundary_uses_static_arns():