@niallthomson or @clareliguori ... thanks for your work on this plugin.
I followed the tutorial, including setting up a analect-gitops-aws-proton-user
with the appropriate aws-proton policies, as mentioned in this issue. For now, I have added the same policies to my gitops
user, in order to be able to work through the tutorial fully.
As part of the aws-proton setup wizard, you are asked to set up a provisioning pipeline role (see below).
![aws_proton_prereq2_provisioning-pipeline-role](https://user-images.githubusercontent.com/4063815/232057340-5a81c376-ab6e-46ea-b244-d8f20f994665.png)
It seems this is required to setup a proton environment (using the UI approach, at least).
![image](https://user-images.githubusercontent.com/4063815/232055006-189aee6d-e0b5-469d-9b29-9d640968f3a0.png)
Since I think the tutorial template is seeking to do this programmatically, then we are somehow not passing that arn-role for the pipeline-role into the docs/tutorial-assets/fargate-nginx-template/template.yaml
file somewhere?
Perhaps this is related to why I am getting an error with missing permissioning for createServiceLinkedRole
.
![image](https://user-images.githubusercontent.com/4063815/232056629-cb28f8a5-dfb5-41aa-87a3-76913619b3eb.png)
To address that temporarily, I added a new policy, although I'm not sure if that is superfluous if there is some fix to what I mention above.
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "iam:CreateServiceLinkedRole",
"Resource": "arn:aws:iam::*:role/aws-service-role/*"
},
{
"Effect": "Allow",
"Action": [
"ec2:DescribeAccountAttributes"
],
"Resource": "*"
}
]
}
On re-running the task, I then get blocked by the absence of the fargate-env
... whose creation I presume should be automated by this task ... but somehow it doesn't know about the pipeline-role. If you can offer any guidance for me to get this resolved. Thanks.
![image](https://user-images.githubusercontent.com/4063815/232061542-21585246-c8e6-41bb-ba12-0e2112d8272e.png)
By the way, this was the ProtonRolePolicy-analect-io-aws-proton-pipeline-role
, as generated by the Wizard.
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"cloudformation:CancelUpdateStack",
"cloudformation:ContinueUpdateRollback",
"cloudformation:CreateChangeSet",
"cloudformation:CreateStack",
"cloudformation:DeleteChangeSet",
"cloudformation:DeleteStack",
"cloudformation:DescribeChangeSet",
"cloudformation:DescribeStackDriftDetectionStatus",
"cloudformation:DescribeStackEvents",
"cloudformation:DescribeStackResourceDrifts",
"cloudformation:DescribeStacks",
"cloudformation:DetectStackResourceDrift",
"cloudformation:ExecuteChangeSet",
"cloudformation:ListChangeSets",
"cloudformation:ListStackResources",
"cloudformation:UpdateStack"
],
"Resource": "arn:aws:cloudformation:*:xxxxxx:stack/AWSProton-*"
},
{
"Effect": "Allow",
"NotAction": [
"organizations:*",
"account:*"
],
"Resource": "*",
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": [
"cloudformation.amazonaws.com"
]
}
}
},
{
"Effect": "Allow",
"Action": [
"organizations:DescribeOrganization",
"account:ListRegions"
],
"Resource": "*",
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": [
"cloudformation.amazonaws.com"
]
}
}
}
]
}