adam/seahaven-org-baseline
1
0
Fork 0
mirror of https://github.com/Sea-Haven-Industries/seahaven-org-baseline.git synced 2026-10-07 10:18:54 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

fix(ci): allow CreateServiceLinkedRole on EKS role names (#184)

Browse source 
CreateFargateProfile authorizes the service-linked role by its pathless name before the role exists.
This commit is contained in:
Adam Moussa 2026-10-05 20:09:46 -04:00 • committed by GitHub
parent ca174d2322
commit 4e68cf1ccf
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 13 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

13
lib/actions-runner-hcptf-stack.ts
View file

@ -421,6 +421,19 @@ function iamPolicyDocument(): object {
}, },
}, },
}, },
{
Sid: "ServiceLinkedRoleNames",
Effect: "Allow",
Action: ["iam:CreateServiceLinkedRole", "iam:TagRole"],
Resource: [
`arn:aws:iam::${ACCOUNT}:role/AWSServiceRoleForAmazonEKS`,
`arn:aws:iam::${ACCOUNT}:role/AWSServiceRoleForAmazonEKSForFargate`,
`arn:aws:iam::${ACCOUNT}:role/AWSServiceRoleForAmazonEKSNodegroup`,
`arn:aws:iam::${ACCOUNT}:role/aws-service-role/eks.amazonaws.com/*`,
`arn:aws:iam::${ACCOUNT}:role/aws-service-role/eks-fargate-pods.amazonaws.com/*`,
`arn:aws:iam::${ACCOUNT}:role/aws-service-role/eks-nodegroup.amazonaws.com/*`,
],
},
{ {
Sid: "PassAwsServiceRoles", Sid: "PassAwsServiceRoles",
Effect: "Allow", Effect: "Allow",