aws-samples / aws-samples/java-spring-boot-ecs-fargate-redis-caching
java-spring-boot-service.yaml File Should use IAM Policy for Auto Scaling
- Dominant language
- Java
- Stars
- 8
- Forks
- 10
- PR merge metrics
- No merged PRs in 30d
Description
Within the file `java-spring-boot-ecs-fargate-redis-caching/cfn/applications/java-spring-boot-service.yaml` there is a resource named `AutoScalingTarget` of type `AWS::ApplicationAutoScaling::ScalableTarget`. At issue here are two things:
1. A AWS provided IAM Managed Policy with the ARN `arn:aws:iam::aws:policy/aws-service-role/AWSApplicationAutoscalingECSServicePolicy` already exists.
2. The particular policy referenced above includes one permission (`cloudwatch:DeleteAlarm`) that the existing policy used in the document does not include.
I would suggest modifying the `AWS::IAM::Role` resource as follows:
```
AutoScalingRole:
Type: AWS::IAM::Role
Properties:
RoleName: !Join ['', [ !Sub "${AWS::StackName}-${ServiceName}", AutoScalingRole]]
AssumeRolePolicyDocument:
Statement:
- Effect: Allow
Principal:
Service: application-autoscaling.amazonaws.com
Action: sts:AssumeRole
ManagedPolicyArns:
- arn:aws:iam::aws:policy/aws-service-role/AWSApplicationAutoscalingECSServicePolicy
```
Contributor guide
Research direction
Open java-spring-boot-ecs-fargate-redis-caching/cfn/applications/java-spring-boot-service.yaml and inspect the AutoScalingRole used by AutoScalingTarget. Compare its current policy with the AWS-managed AWSApplicationAutoscalingECSServicePolicy ARN given in the issue. Done means the role references that managed policy and includes the required CloudWatch delete-alarm permission through it.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, java, spring-boot
- Domain
- cloud, infrastructure, security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 48/100