aws-samples / aws-samples/java-spring-boot-ecs-fargate-redis-caching

java-spring-boot-service.yaml File Should use IAM Policy for Auto Scaling

Open
#3 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
Java
Stars
8
Forks
10
PR merge metrics
No merged PRs in 30d

Description

Within the file `java-spring-boot-ecs-fargate-redis-caching/cfn/applications/java-spring-boot-service.yaml` there is a resource named `AutoScalingTarget` of type `AWS::ApplicationAutoScaling::ScalableTarget`. At issue here are two things:

1. A AWS provided IAM Managed Policy with the ARN `arn:aws:iam::aws:policy/aws-service-role/AWSApplicationAutoscalingECSServicePolicy` already exists.
2. The particular policy referenced above includes one permission (`cloudwatch:DeleteAlarm`) that the existing policy used in the document does not include.

I would suggest modifying the `AWS::IAM::Role` resource as follows:

```
AutoScalingRole:
Type: AWS::IAM::Role
Properties:
RoleName: !Join ['', [ !Sub "${AWS::StackName}-${ServiceName}", AutoScalingRole]]
AssumeRolePolicyDocument:
Statement:
- Effect: Allow
Principal:
Service: application-autoscaling.amazonaws.com
Action: sts:AssumeRole
ManagedPolicyArns:
- arn:aws:iam::aws:policy/aws-service-role/AWSApplicationAutoscalingECSServicePolicy
```

Contributor guide

Open the contributing guide

Research direction

Open java-spring-boot-ecs-fargate-redis-caching/cfn/applications/java-spring-boot-service.yaml and inspect the AutoScalingRole used by AutoScalingTarget. Compare its current policy with the AWS-managed AWSApplicationAutoscalingECSServicePolicy ARN given in the issue. Done means the role references that managed policy and includes the required CloudWatch delete-alarm permission through it.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, java, spring-boot
Domain
cloud, infrastructure, security
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.