aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap
AWS::AutoScaling::AutoScalingGroup - Return full ARN or GroupId
- Dominant language
- No language data
- Stars
- 1.1k
- Forks
- 62
- PR merge metrics
- No merged PRs in 30d
Description
### Name of the resource
AWS::AutoScaling::AutoScalingGroup
### Resource name
AWS::AutoScaling::AutoScalingGroup
### Description
We are trying to create a Lambda to trigger an instance refresh on an Autoscaling Group.
When creating the Lambda IAM Permissions we noticed that `AWS::AutoScaling::AutoScalingGroup` does *not* export full ARN nor `GroupId` as required for `autoscaling:StartInstanceRefresh`
ARN Required by `autoscaling:StartInstanceRefresh`
```
arn:${Partition}:autoscaling:${Region}:${Account}:autoScalingGroup:${GroupId}:autoScalingGroupName/${GroupFriendlyName}
```
`Ref` from `AWS::AutoScaling::AutoScalingGroup` is Friendly Name.
So currently as workaround we add a `*` to `GroupId`, but does not conform against AWS Security Best Practices, namely the Least Privilege Principle.
Is it possible to make `AWS::AutoScaling::AutoScalingGroup` return the Full ARN or GroupId on CloudFormation?
Thanks
### Other Details
_No response_
Contributor guide
Research direction
Start with the AWS::AutoScaling::AutoScalingGroup return behavior and the autoscaling:StartInstanceRefresh ARN requirements described in the issue. Done means the resource exposes either the full ARN or GroupId so a Lambda IAM policy can use the specific Auto Scaling group instead of a wildcard.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws
- Domain
- cloud
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100