adam/seahaven-org-baseline
1
0
Fork 0
mirror of https://github.com/Sea-Haven-Industries/seahaven-org-baseline.git synced 2026-10-07 05:41:59 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

fix(ci): let the runner roles read the EKS AL2023 AMI parameter (#187)
Some checks are pending
Deploy / deploy-management (push) Waiting to run
Details
Deploy / deploy-external-dev (push) Waiting to run
Details
Deploy / deploy-security (push) Waiting to run
Details
Deploy / deploy-dev (push) Waiting to run
Details
Deploy / deploy-prod (push) Waiting to run
Details
Deploy / deploy-ci (push) Waiting to run
Details

Browse source 
The managed node group plan reads the public recommended AMI version. That parameter was outside the existing SSM grant.
This commit is contained in:
Adam Moussa 2026-10-06 12:46:08 -04:00 • committed by GitHub
parent e8e60dbad6
commit 6a251d49e1
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 10 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

11
lib/actions-runner-hcptf-stack.ts
View file

@ -304,6 +304,12 @@ function servicesPolicy(): object {
],
Resource: `arn:aws:ssm:us-east-1:${ACCOUNT}:parameter/${prefix}/*`,
},
{
Sid: "EksAmiRead",
Effect: "Allow",
Action: ["ssm:GetParameter", "ssm:GetParameters"],
Resource: "arn:aws:ssm:us-east-1::parameter/aws/service/eks/optimized-ami/1.34/amazon-linux-2023/x86_64/standard/recommended/*",
},
{
Sid: "SsmList",
Effect: "Allow",
@ -533,7 +539,10 @@ function planPolicy(hcpArn: string, githubArn: string): object {
Sid: "SsmReads",
Effect: "Allow",
Action: ["ssm:GetParameter", "ssm:GetParameters", "ssm:ListTagsForResource"],
Resource: `arn:aws:ssm:us-east-1:${ACCOUNT}:parameter/actions-runner/*`,
Resource: [
`arn:aws:ssm:us-east-1:${ACCOUNT}:parameter/actions-runner/*`,
"arn:aws:ssm:us-east-1::parameter/aws/service/eks/optimized-ami/1.34/amazon-linux-2023/x86_64/standard/recommended/*",
],
},
],
};