From 181691c3dc4bd61d75a8904a0144cb78b0e48e87 Mon Sep 17 00:00:00 2001 From: brandizzi Date: Thu, 30 Jul 2026 11:55:07 -0300 Subject: [PATCH] fix(cdk): allow Beanstalk VPC discovery --- infra/cdk/README.md | 6 ++++++ infra/cdk/deploy-dev-stack.ts | 1 + 2 files changed, 7 insertions(+) diff --git a/infra/cdk/README.md b/infra/cdk/README.md index e32d030..a6cf1c1 100644 --- a/infra/cdk/README.md +++ b/infra/cdk/README.md @@ -210,6 +210,12 @@ it intentionally does not copy the managed `s3:Put*`, or `s3:Delete*` grants. Any later denial must be evaluated and granted independently. +The July 30 deployment of backend PR #41 then reached `UpdateEnvironment` and +failed on `ec2:DescribeVpcs`. Elastic Beanstalk performs this read-only network +discovery using the initiating role, so the CDK policy includes that action +alongside the existing EC2 describe permissions. It remains resource `*` +because `DescribeVpcs` does not support resource-level permissions. + The pinned deployment action can return success after Elastic Beanstalk emits a fatal deployment event. The following workflow step therefore verifies that the exact immutable version label is active and healthy before smoke testing. diff --git a/infra/cdk/deploy-dev-stack.ts b/infra/cdk/deploy-dev-stack.ts index 0cdef0c..4699358 100644 --- a/infra/cdk/deploy-dev-stack.ts +++ b/infra/cdk/deploy-dev-stack.ts @@ -108,6 +108,7 @@ export class DeployDevStack extends cdk.Stack { 'ec2:DescribeAvailabilityZones', 'ec2:DescribeImages', 'ec2:DescribeSubnets', + 'ec2:DescribeVpcs', ], resources: ['*'], }),