aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap

AWS::AutoScaling::AutoScalingGroup - Return full ARN or GroupId

Open
#1,175 4 comments 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
No language data
Stars
1.1k
Forks
62
PR merge metrics
No merged PRs in 30d

Description

### Name of the resource

AWS::AutoScaling::AutoScalingGroup

### Resource name

AWS::AutoScaling::AutoScalingGroup

### Description

We are trying to create a Lambda to trigger an instance refresh on an Autoscaling Group.

When creating the Lambda IAM Permissions we noticed that `AWS::AutoScaling::AutoScalingGroup` does *not* export full ARN nor `GroupId` as required for `autoscaling:StartInstanceRefresh`

ARN Required by `autoscaling:StartInstanceRefresh`
```
arn:${Partition}:autoscaling:${Region}:${Account}:autoScalingGroup:${GroupId}:autoScalingGroupName/${GroupFriendlyName}
```

`Ref` from `AWS::AutoScaling::AutoScalingGroup` is Friendly Name.

So currently as workaround we add a `*` to `GroupId`, but does not conform against AWS Security Best Practices, namely the Least Privilege Principle.

Is it possible to make `AWS::AutoScaling::AutoScalingGroup` return the Full ARN or GroupId on CloudFormation?

Thanks

### Other Details

_No response_

Contributor guide

Open the contributing guide

Research direction

Start with the AWS::AutoScaling::AutoScalingGroup return behavior and the autoscaling:StartInstanceRefresh ARN requirements described in the issue. Done means the resource exposes either the full ARN or GroupId so a Lambda IAM policy can use the specific Auto Scaling group instead of a wildcard.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws
Domain
cloud
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.