Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

cleanup: remove unused resources associated to former EC2 VM agents and their AMIs #473

Merged
merged 1 commit into from
Oct 19, 2023

Conversation

dduportal
Copy link
Contributor

Related to jenkins-infra/helpdesk#3662, this PR removes resources unused for months since we moved away VM agents from AWS (ref. jenkins-infra/helpdesk#3502).

…nd the maintenance of their AMIs

Signed-off-by: Damien Duportal <damien.duportal@gmail.com>
Comment on lines -2 to -4
data "aws_iam_user" "jenkins_infra_ci" {
user_name = "jenkins-infra-ci"
}
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Note: to be deleted manually (tracked in jenkins-infra/helpdesk#3662 (comment))

Comment on lines -57 to -59
data "aws_iam_user" "jenkins_ci" {
user_name = "jenkins-ci"
}
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Note: to be deleted manually (tracked in jenkins-infra/helpdesk#3662 (comment))

@dduportal
Copy link
Contributor Author

Plan: 0 to add, 0 to change, 11 to destroy.

as expected

@dduportal dduportal merged commit 2c240e8 into jenkins-infra:main Oct 19, 2023
7 checks passed
@dduportal dduportal deleted the cleanup/ec2-agents-and-amis branch October 19, 2023 10:11
@dduportal
Copy link
Contributor Author

For info, the terraform apply of this PR failed with the following error:

Error: removing policy arn:aws:iam::<redacted>:policy/jenkins_ec2_agents from IAM User jenkins-ci: AccessDenied: User: arn:aws:iam::<redacted>:user/<redacted> is not authorized to perform: iam:DetachUserPolicy on resource: user jenkins-ci because no identity-based policy allows the iam:DetachUserPolicy action

3 times (for the 3 users: updatecli , jenkins-ci and jenkins-infra-ci`).

Proposal: No need to add the permission iam:DetachUserPolicy to our technical users (in the private repo jenkins-infra/terraform-states) for safety reasons. Since this is a one-time operation, i'll detach the permissiosn from users and will re-trigger the terraform job

@dduportal
Copy link
Contributor Author

Done with success!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants