fix: The provided credentials do not have permission to create the se…

…rvice-linked role for EC2 Spot Instances (#183) Fixes #182
CloudSnorkel · Dec 9, 2022 · 9f3c537 · 9f3c537
1 parent 3441881
commit 9f3c537
Show file tree

Hide file tree

Showing 5 changed files with 33 additions and 3 deletions.
diff --git a/src/providers/ec2.ts b/src/providers/ec2.ts
@@ -383,6 +383,16 @@ export class Ec2Runner extends BaseProvider implements IRunnerProvider {
         resource: '*',
       })],
     }));
+
+    stateMachineRole.grantPrincipal.addToPrincipalPolicy(new iam.PolicyStatement({
+      actions: ['iam:CreateServiceLinkedRole'],
+      resources: ['*'],
+      conditions: {
+        StringEquals: {
+          'iam:AWSServiceName': 'spot.amazonaws.com',
+        },
+      },
+    }));
   }
 
   status(statusFunctionRole: iam.IGrantable): IRunnerProviderStatus {

diff --git a/test/default.integ.snapshot/github-runners-test.assets.json b/test/default.integ.snapshot/github-runners-test.assets.json
@@ -222,15 +222,15 @@
         }
       }
     },
-    "cb8b028063cbb5d802bc47dc5ba6314eaf9e718d1c9f0f62decd46320644f7a3": {
+    "1a0f45935e02a2424625930ad31932af8f58e40cd46546b8f0a367ae34ee2539": {
       "source": {
         "path": "github-runners-test.template.json",
         "packaging": "file"
       },
       "destinations": {
         "current_account-current_region": {
           "bucketName": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}",
-          "objectKey": "cb8b028063cbb5d802bc47dc5ba6314eaf9e718d1c9f0f62decd46320644f7a3.json",
+          "objectKey": "1a0f45935e02a2424625930ad31932af8f58e40cd46546b8f0a367ae34ee2539.json",
           "assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-file-publishing-role-${AWS::AccountId}-${AWS::Region}"
         }
       }

diff --git a/test/default.integ.snapshot/github-runners-test.template.json b/test/default.integ.snapshot/github-runners-test.template.json
@@ -11044,6 +11044,16 @@
         ]
        }
       },
+      {
+       "Action": "iam:CreateServiceLinkedRole",
+       "Condition": {
+        "StringEquals": {
+         "iam:AWSServiceName": "spot.amazonaws.com"
+        }
+       },
+       "Effect": "Allow",
+       "Resource": "*"
+      },
       {
        "Action": "iam:PassRole",
        "Condition": {

diff --git a/test/default.integ.snapshot/manifest.json b/test/default.integ.snapshot/manifest.json
@@ -23,7 +23,7 @@
         "validateOnSynth": false,
         "assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-deploy-role-${AWS::AccountId}-${AWS::Region}",
         "cloudFormationExecutionRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-cfn-exec-role-${AWS::AccountId}-${AWS::Region}",
-        "stackTemplateAssetObjectUrl": "s3://cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}/cb8b028063cbb5d802bc47dc5ba6314eaf9e718d1c9f0f62decd46320644f7a3.json",
+        "stackTemplateAssetObjectUrl": "s3://cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}/1a0f45935e02a2424625930ad31932af8f58e40cd46546b8f0a367ae34ee2539.json",
         "requiresBootstrapStackVersion": 6,
         "bootstrapStackVersionSsmParameter": "/cdk-bootstrap/hnb659fds/version",
         "additionalDependencies": [

diff --git a/test/default.integ.snapshot/tree.json b/test/default.integ.snapshot/tree.json
@@ -14904,6 +14904,16 @@
                                         ]
                                       }
                                     },
+                                    {
+                                      "Action": "iam:CreateServiceLinkedRole",
+                                      "Condition": {
+                                        "StringEquals": {
+                                          "iam:AWSServiceName": "spot.amazonaws.com"
+                                        }
+                                      },
+                                      "Effect": "Allow",
+                                      "Resource": "*"
+                                    },
                                     {
                                       "Action": "iam:PassRole",
                                       "Condition": {