adam/shoc-backend
1
0
Fork 0
mirror of https://github.com/Sea-Haven-Industries/shoc-backend.git synced 2026-10-07 16:19:07 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

fix(cdk): allow Beanstalk VPC discovery

Browse source
This commit is contained in:
brandizzi 2026-07-30 11:55:07 -03:00
parent 83ed6a1790
commit 181691c3dc
2 changed files with 7 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
infra/cdk/README.md
View file

@ -210,6 +210,12 @@ it intentionally does not copy the managed
`s3:Put*`, or `s3:Delete*` grants. Any later denial must be evaluated and `s3:Put*`, or `s3:Delete*` grants. Any later denial must be evaluated and
granted independently. granted independently.
The July 30 deployment of backend PR #41 then reached `UpdateEnvironment` and
failed on `ec2:DescribeVpcs`. Elastic Beanstalk performs this read-only network
discovery using the initiating role, so the CDK policy includes that action
alongside the existing EC2 describe permissions. It remains resource `*`
because `DescribeVpcs` does not support resource-level permissions.
The pinned deployment action can return success after Elastic Beanstalk emits a The pinned deployment action can return success after Elastic Beanstalk emits a
fatal deployment event. The following workflow step therefore verifies that fatal deployment event. The following workflow step therefore verifies that
the exact immutable version label is active and healthy before smoke testing. the exact immutable version label is active and healthy before smoke testing.

1
infra/cdk/deploy-dev-stack.ts
View file

@ -108,6 +108,7 @@ export class DeployDevStack extends cdk.Stack {
'ec2:DescribeAvailabilityZones', 'ec2:DescribeAvailabilityZones',
'ec2:DescribeImages', 'ec2:DescribeImages',
'ec2:DescribeSubnets', 'ec2:DescribeSubnets',
'ec2:DescribeVpcs',
], ],
resources: ['*'], resources: ['*'],
}), }),