adam/shoc-backend
1
0
Fork 0
mirror of https://github.com/Sea-Haven-Industries/shoc-backend.git synced 2026-10-07 16:19:07 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

fix(cdk): allow Beanstalk resource discovery

Browse source
This commit is contained in:
brandizzi 2026-07-30 12:32:03 -03:00
parent 6fa6277808
commit 52dbdde576
2 changed files with 10 additions and 32 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
infra/cdk/README.md
View file

@ -238,6 +238,13 @@ The next rerun cleared S3 and then required the read-only
managed-stack update also required `cloudformation:CancelUpdateStack`; the managed-stack update also required `cloudformation:CancelUpdateStack`; the
cancel action is scoped to the same single stack ARN as `UpdateStack`. cancel action is scoped to the same single stack ARN as `UpdateStack`.
The subsequent rerun progressed into Auto Scaling and required
`autoscaling:DescribeLaunchConfigurations`. Because Elastic Beanstalk's
managed update workflow performs variable resource discovery, the role follows
the documented read-only discovery families for EC2, Elastic Load Balancing,
and Auto Scaling (`Describe*`). These grants expose metadata across the account
but do not authorize any mutation; write actions remain separately scoped.
The pinned deployment action can return success after Elastic Beanstalk emits a The pinned deployment action can return success after Elastic Beanstalk emits a
fatal deployment event. The following workflow step therefore verifies that fatal deployment event. The following workflow step therefore verifies that
the exact immutable version label is active and healthy before smoke testing. the exact immutable version label is active and healthy before smoke testing.

35
infra/cdk/deploy-dev-stack.ts
View file

@ -43,9 +43,12 @@ export class DeployDevStack extends cdk.Stack {
new iam.PolicyStatement({ new iam.PolicyStatement({
effect: iam.Effect.ALLOW, effect: iam.Effect.ALLOW,
actions: [ actions: [
'autoscaling:Describe*',
'ec2:Describe*',
'elasticbeanstalk:DescribeEnvironments', 'elasticbeanstalk:DescribeEnvironments',
'elasticbeanstalk:DescribeApplicationVersions', 'elasticbeanstalk:DescribeApplicationVersions',
'elasticbeanstalk:DescribeEvents', 'elasticbeanstalk:DescribeEvents',
'elasticloadbalancing:Describe*',
], ],
resources: ['*'], resources: ['*'],
}), }),
@ -89,38 +92,6 @@ export class DeployDevStack extends cdk.Stack {
}), }),
); );
deployRole.addToPolicy(
new iam.PolicyStatement({
effect: iam.Effect.ALLOW,
actions: [
'ec2:DescribeAvailabilityZones',
'ec2:DescribeImages',
'ec2:DescribeSubnets',
'ec2:DescribeVpcs',
],
resources: ['*'],
}),
);
deployRole.addToPolicy(
new iam.PolicyStatement({
effect: iam.Effect.ALLOW,
actions: ['elasticloadbalancing:DescribeLoadBalancers'],
resources: ['*'],
}),
);
deployRole.addToPolicy(
new iam.PolicyStatement({
effect: iam.Effect.ALLOW,
actions: [
'autoscaling:DescribeAutoScalingGroups',
'autoscaling:DescribeScalingActivities',
],
resources: ['*'],
}),
);
deployRole.addToPolicy( deployRole.addToPolicy(
new iam.PolicyStatement({ new iam.PolicyStatement({
effect: iam.Effect.ALLOW, effect: iam.Effect.ALLOW,