adam/syslog-server
1
0
Fork 0
mirror of https://github.com/Sea-Haven-Industries/syslog-server.git synced 2026-09-30 05:23:16 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

fix(infra): allow scoped apply to create the EC2 recover alarm

Browse source 
PutMetricAlarm with the automate recover action needs RecoverInstances plus CreateServiceLinkedRole for AWSServiceRoleForCloudWatchEvents, which does not exist in seahaven-prod yet.
This commit is contained in:
Adam Moussa 2026-09-16 17:44:29 -04:00
parent e17b284370
commit 57fba0c87f
No known key found for this signature in database
1 changed files with 19 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

19
terraform/hcp_iam.tf
View file

@ -392,6 +392,7 @@ data "aws_iam_policy_document" "hcptf_apply_services" {
"ec2:DescribeImages",
"ec2:DescribeInstanceAttribute",
"ec2:DescribeInstanceCreditSpecifications",
"ec2:DescribeInstanceRecoveryAttribute",
"ec2:DescribeInstanceStatus",
"ec2:DescribeInstanceTypes",
"ec2:DescribeInstances",
@ -405,6 +406,7 @@ data "aws_iam_policy_document" "hcptf_apply_services" {
"ec2:ModifyVolume",
"ec2:MonitorInstances",
"ec2:RebootInstances",
"ec2:RecoverInstances",
"ec2:ReplaceIamInstanceProfileAssociation",
"ec2:RunInstances",
"ec2:StartInstances",
@ -414,6 +416,22 @@ data "aws_iam_policy_document" "hcptf_apply_services" {
]
resources = ["*"]
}
statement {
sid = "CloudWatchEc2RecoverServiceLinkedRole"
effect = "Allow"
actions = [
"iam:CreateServiceLinkedRole",
]
resources = [
"arn:aws:iam::${local.account_id}:role/aws-service-role/events.amazonaws.com/AWSServiceRoleForCloudWatchEvents",
]
condition {
test = "StringEquals"
variable = "iam:AWSServiceName"
values = ["events.amazonaws.com"]
}
}
}
data "aws_iam_policy_document" "hcptf_plan_refresh" {
@ -489,6 +507,7 @@ data "aws_iam_policy_document" "hcptf_plan_refresh" {
"ec2:DescribeImages",
"ec2:DescribeInstanceAttribute",
"ec2:DescribeInstanceCreditSpecifications",
"ec2:DescribeInstanceRecoveryAttribute",
"ec2:DescribeInstanceStatus",
"ec2:DescribeInstanceTypes",
"ec2:DescribeInstances",