adam/seahaven-org-baseline
1
0
Fork 0
mirror of https://github.com/Sea-Haven-Industries/seahaven-org-baseline.git synced 2026-10-06 18:01:59 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

fix(ci): let the runner plan role refresh cluster resources (#182)

Browse source
This commit is contained in:
Adam Moussa 2026-10-05 19:53:46 -04:00 • committed by GitHub
parent ce41cfecda
commit d5bd21519e
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 23 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

23
lib/actions-runner-hcptf-stack.ts
View file

@ -442,20 +442,43 @@ function planPolicy(hcpArn: string, githubArn: string): object {
"iam:GetRole",
"iam:GetRolePolicy",
"iam:ListAttachedRolePolicies",
"iam:ListPolicyTags",
"iam:ListRolePolicies",
"iam:ListRoleTags",
],
Resource: [
`arn:aws:iam::${ACCOUNT}:role/actions-runner*`,
`arn:aws:iam::${ACCOUNT}:role/tf-managed/*`,
`arn:aws:iam::${ACCOUNT}:role/aws-service-role/eks.amazonaws.com/*`,
`arn:aws:iam::${ACCOUNT}:role/aws-service-role/eks-fargate-pods.amazonaws.com/*`,
`arn:aws:iam::${ACCOUNT}:role/aws-service-role/eks-nodegroup.amazonaws.com/*`,
`arn:aws:iam::${ACCOUNT}:role/hcptf-actions-runner`,
`arn:aws:iam::${ACCOUNT}:role/hcptf-actions-runner-plan`,
`arn:aws:iam::${ACCOUNT}:role/githubdeploy-seahaven-org-baseline`,
`arn:aws:iam::${ACCOUNT}:policy/actions-runner*`,
`arn:aws:iam::${ACCOUNT}:policy/tf-managed/*`,
`arn:aws:iam::${ACCOUNT}:oidc-provider/oidc.eks.us-east-1.amazonaws.com/id/*`,
hcpArn,
githubArn,
],
},
{
Sid: "CollectionReads",
Effect: "Allow",
Action: ["kms:ListAliases", "ssm:DescribeParameters"],
Resource: "*",
},
{
Sid: "EcrReads",
Effect: "Allow",
Action: [
"ecr:DescribeRepositories",
"ecr:GetLifecyclePolicy",
"ecr:GetRepositoryPolicy",
"ecr:ListTagsForResource",
],
Resource: `arn:aws:ecr:us-east-1:${ACCOUNT}:repository/actions-runner`,
},
{
Sid: "EksAccessReads",
Effect: "Allow",