Skip to content

Commit

Permalink
fix(ecs): Scope-down IAM permissions for ECS drain (#9502)
Browse files Browse the repository at this point in the history 
Fixes #9501

### Testing

This was tested by deploying a simple app that was basically the sample from the ECS module readme, and then manually killing off instances from the ECS cluster's ASG. When I killed off an instance I then verified, from the lambda logs, that the task-draining lambda was able to complete its work with no errors.

The essentials of the app are:
```ts
const app = new cdk.App();

const env = {
    account: process.env.CDK_DEFAULT_ACCOUNT,
    region: process.env.CDK_DEFAULT_REGION
}

const stack = new cdk.Stack(app, 'Testing', { env });
const vpc = new ec2.Vpc(stack, 'Vpc');

// Create an ECS cluster
const cluster = new ecs.Cluster(stack, 'Cluster', {
  vpc,
});

// Add capacity to it
cluster.addCapacity('DefaultAutoScalingGroupCapacity', {
  instanceType: new ec2.InstanceType("t2.xlarge"),
  desiredCapacity: 2,
});

const taskDefinition = new ecs.Ec2TaskDefinition(stack, 'TaskDef');

taskDefinition.addContainer('DefaultContainer', {
  image: ecs.ContainerImage.fromRegistry("amazon/amazon-ecs-sample"),
  memoryLimitMiB: 512,
  logging: ecs.LogDriver.awsLogs({
    logGroup: new logs.LogGroup(stack, 'LogGroup', {
      logGroupName: '/test-group/',
      removalPolicy: cdk.RemovalPolicy.DESTROY,
      retention: logs.RetentionDays.ONE_DAY,
    }),
    streamPrefix: 'testing-',
  }),
});

// Instantiate an Amazon ECS Service
const ecsService = new ecs.Ec2Service(stack, 'Service', {
  cluster,
  taskDefinition,
  desiredCount: 2,
});
```

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
  • Loading branch information
@ddneilson
ddneilson committed Aug 7, 2020
1 parent 76a7bfd commit 9fbeec3
Show file tree
Hide file tree
Showing 15 changed files with 167 additions and 14 deletions.
12 changes: 11 additions & 1 deletion ...-ecs-patterns/test/ec2/integ.multiple-application-load-balanced-ecs-service.expected.json
View file
Original file line number Diff line number Diff line change
Expand Up @@ -658,7 +658,17 @@
"ecs:DescribeTasks"
],
"Effect": "Allow",
"Resource": "*"
"Resource": "*",
"Condition": {
"ArnEquals": {
"ecs:cluster": {
"Fn::GetAtt": [
"ClusterEB0386A7",
"Arn"
]
}
}
}
},
{
"Action": [
Expand Down
12 changes: 11 additions & 1 deletion packages/@aws-cdk/aws-ecs-patterns/test/ec2/integ.scheduled-ecs-task.lit.expected.json
View file
Original file line number Diff line number Diff line change
Expand Up @@ -474,7 +474,17 @@
"ecs:DescribeTasks"
],
"Effect": "Allow",
"Resource": "*"
"Resource": "*",
"Condition": {
"ArnEquals": {
"ecs:cluster": {
"Fn::GetAtt": [
"EcsCluster97242B84",
"Arn"
]
}
}
}
},
{
"Action": [
Expand Down
3 changes: 3 additions & 0 deletions packages/@aws-cdk/aws-ecs/lib/drain-hook/instance-drain-hook.ts
View file
Original file line number Diff line number Diff line change
Expand Up @@ -90,6 +90,9 @@ export class InstanceDrainHook extends cdk.Construct {
fn.addToRolePolicy(new iam.PolicyStatement({
actions: ['ecs:DescribeContainerInstances', 'ecs:DescribeTasks'],
resources: ['*'],
conditions: {
ArnEquals: { 'ecs:cluster': props.cluster.clusterArn },
},
}));

// Restrict to the ECS Cluster
Expand Down
12 changes: 11 additions & 1 deletion packages/@aws-cdk/aws-ecs/test/ec2/integ.app-mesh-proxy-config.expected.json
View file
Original file line number Diff line number Diff line change
Expand Up @@ -637,7 +637,17 @@
"ecs:DescribeTasks"
],
"Effect": "Allow",
"Resource": "*"
"Resource": "*",
"Condition": {
"ArnEquals": {
"ecs:cluster": {
"Fn::GetAtt": [
"EcsCluster97242B84",
"Arn"
]
}
}
}
},
{
"Action": [
Expand Down
12 changes: 11 additions & 1 deletion packages/@aws-cdk/aws-ecs/test/ec2/integ.clb-host-nw.expected.json
View file
Original file line number Diff line number Diff line change
Expand Up @@ -658,7 +658,17 @@
"ecs:DescribeTasks"
],
"Effect": "Allow",
"Resource": "*"
"Resource": "*",
"Condition": {
"ArnEquals": {
"ecs:cluster": {
"Fn::GetAtt": [
"EcsCluster97242B84",
"Arn"
]
}
}
}
},
{
"Action": [
Expand Down
12 changes: 11 additions & 1 deletion packages/@aws-cdk/aws-ecs/test/ec2/integ.firelens-s3-config.expected.json
View file
Original file line number Diff line number Diff line change
Expand Up @@ -637,7 +637,17 @@
"ecs:DescribeTasks"
],
"Effect": "Allow",
"Resource": "*"
"Resource": "*",
"Condition": {
"ArnEquals": {
"ecs:cluster": {
"Fn::GetAtt": [
"EcsCluster97242B84",
"Arn"
]
}
}
}
},
{
"Action": [
Expand Down
12 changes: 11 additions & 1 deletion packages/@aws-cdk/aws-ecs/test/ec2/integ.lb-awsvpc-nw.expected.json
View file
Original file line number Diff line number Diff line change
Expand Up @@ -637,7 +637,17 @@
"ecs:DescribeTasks"
],
"Effect": "Allow",
"Resource": "*"
"Resource": "*",
"Condition": {
"ArnEquals": {
"ecs:cluster": {
"Fn::GetAtt": [
"EcsCluster97242B84",
"Arn"
]
}
}
}
},
{
"Action": [
Expand Down
12 changes: 11 additions & 1 deletion packages/@aws-cdk/aws-ecs/test/ec2/integ.lb-bridge-nw.expected.json
View file
Original file line number Diff line number Diff line change
Expand Up @@ -658,7 +658,17 @@
"ecs:DescribeTasks"
],
"Effect": "Allow",
"Resource": "*"
"Resource": "*",
"Condition": {
"ArnEquals": {
"ecs:cluster": {
"Fn::GetAtt": [
"EcsCluster97242B84",
"Arn"
]
}
}
}
},
{
"Action": [
Expand Down
12 changes: 11 additions & 1 deletion packages/@aws-cdk/aws-ecs/test/ec2/integ.sd-awsvpc-nw.expected.json
View file
Original file line number Diff line number Diff line change
Expand Up @@ -637,7 +637,17 @@
"ecs:DescribeTasks"
],
"Effect": "Allow",
"Resource": "*"
"Resource": "*",
"Condition": {
"ArnEquals": {
"ecs:cluster": {
"Fn::GetAtt": [
"EcsCluster97242B84",
"Arn"
]
}
}
}
},
{
"Action": [
Expand Down
12 changes: 11 additions & 1 deletion packages/@aws-cdk/aws-ecs/test/ec2/integ.sd-bridge-nw.expected.json
View file
Original file line number Diff line number Diff line change
Expand Up @@ -637,7 +637,17 @@
"ecs:DescribeTasks"
],
"Effect": "Allow",
"Resource": "*"
"Resource": "*",
"Condition": {
"ArnEquals": {
"ecs:cluster": {
"Fn::GetAtt": [
"EcsCluster97242B84",
"Arn"
]
}
}
}
},
{
"Action": [
Expand Down
24 changes: 22 additions & 2 deletions packages/@aws-cdk/aws-ecs/test/ec2/integ.spot-drain.expected.json
View file
Original file line number Diff line number Diff line change
Expand Up @@ -639,7 +639,17 @@
"ecs:DescribeTasks"
],
"Effect": "Allow",
"Resource": "*"
"Resource": "*",
"Condition": {
"ArnEquals": {
"ecs:cluster": {
"Fn::GetAtt": [
"EcsCluster97242B84",
"Arn"
]
}
}
}
},
{
"Action": [
Expand Down Expand Up @@ -1110,7 +1120,17 @@
"ecs:DescribeTasks"
],
"Effect": "Allow",
"Resource": "*"
"Resource": "*",
"Condition": {
"ArnEquals": {
"ecs:cluster": {
"Fn::GetAtt": [
"EcsCluster97242B84",
"Arn"
]
}
}
}
},
{
"Action": [
Expand Down
10 changes: 10 additions & 0 deletions packages/@aws-cdk/aws-ecs/test/test.ecs-cluster.ts
View file
Original file line number Diff line number Diff line change
Expand Up @@ -444,6 +444,16 @@ export = {
],
Effect: 'Allow',
Resource: '*',
Condition: {
ArnEquals: {
'ecs:cluster': {
'Fn::GetAtt': [
'EcsCluster97242B84',
'Arn',
],
},
},
},
},
{
Action: [
Expand Down
12 changes: 11 additions & 1 deletion packages/@aws-cdk/aws-events-targets/test/ecs/integ.event-ec2-task.lit.expected.json
View file
Original file line number Diff line number Diff line change
Expand Up @@ -475,7 +475,17 @@
"ecs:DescribeTasks"
],
"Effect": "Allow",
"Resource": "*"
"Resource": "*",
"Condition": {
"ArnEquals": {
"ecs:cluster": {
"Fn::GetAtt": [
"EcsCluster97242B84",
"Arn"
]
}
}
}
},
{
"Action": [
Expand Down
12 changes: 11 additions & 1 deletion packages/@aws-cdk/aws-stepfunctions-tasks/test/ecs/integ.ec2-run-task.expected.json
View file
Original file line number Diff line number Diff line change
Expand Up @@ -269,7 +269,17 @@
"ecs:DescribeTasks"
],
"Effect": "Allow",
"Resource": "*"
"Resource": "*",
"Condition": {
"ArnEquals": {
"ecs:cluster": {
"Fn::GetAtt": [
"Ec2ClusterEE43E89D",
"Arn"
]
}
}
}
},
{
"Action": [
Expand Down
12 changes: 11 additions & 1 deletion packages/@aws-cdk/aws-stepfunctions-tasks/test/ecs/integ.ec2-task.expected.json
View file
Original file line number Diff line number Diff line change
Expand Up @@ -269,7 +269,17 @@
"ecs:DescribeTasks"
],
"Effect": "Allow",
"Resource": "*"
"Resource": "*",
"Condition": {
"ArnEquals": {
"ecs:cluster": {
"Fn::GetAtt": [
"FargateCluster7CCD5F93",
"Arn"
]
}
}
}
},
{
"Action": [
Expand Down

0 comments on commit 9fbeec3

Please sign in to comment.