adam/shoc-backend
1
0
Fork 0
mirror of https://github.com/Sea-Haven-Industries/shoc-backend.git synced 2026-10-07 16:19:07 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

fix(cdk): allow Beanstalk template read

Browse source
This commit is contained in:
brandizzi 2026-07-30 12:15:21 -03:00
parent 809aa3f3cf
commit 9966c22240
2 changed files with 6 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
infra/cdk/README.md
View file

@ -228,6 +228,11 @@ CloudFormation update, which required `cloudformation:UpdateStack`. That
mutation is limited to the single existing Elastic Beanstalk-managed stack ARN mutation is limited to the single existing Elastic Beanstalk-managed stack ARN
for `shoc-backend-dev`; it cannot create stacks or update any other stack. for `shoc-backend-dev`; it cannot create stacks or update any other stack.
Once `UpdateStack` was allowed, CloudFormation returned `S3 error: Access
Denied` while resolving the Elastic Beanstalk-managed template. The caller
therefore receives `s3:GetObject` on the same Beanstalk-only object namespace;
the policy still does not grant `s3:Get*` or access to other bucket names.
The pinned deployment action can return success after Elastic Beanstalk emits a The pinned deployment action can return success after Elastic Beanstalk emits a
fatal deployment event. The following workflow step therefore verifies that fatal deployment event. The following workflow step therefore verifies that
the exact immutable version label is active and healthy before smoke testing. the exact immutable version label is active and healthy before smoke testing.

2
infra/cdk/deploy-dev-stack.ts
View file

@ -211,7 +211,7 @@ export class DeployDevStack extends cdk.Stack {
deployRole.addToPolicy( deployRole.addToPolicy(
new iam.PolicyStatement({ new iam.PolicyStatement({
effect: iam.Effect.ALLOW, effect: iam.Effect.ALLOW,
actions: ['s3:DeleteObject', 's3:GetObjectAcl'], actions: ['s3:DeleteObject', 's3:GetObject', 's3:GetObjectAcl'],
// UpdateEnvironment also checks and removes temporary objects in // UpdateEnvironment also checks and removes temporary objects in
// AWS-owned Elastic Beanstalk buckets. AWS Support case // AWS-owned Elastic Beanstalk buckets. AWS Support case
// 178526484500047 confirmed that the caller's identity policy must // 178526484500047 confirmed that the caller's identity policy must