Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: AMI cleaner not authorized to perform: ec2:DeregisterImage with multiple builders #519

Merged
merged 2 commits into from
Mar 9, 2024

Conversation

kichik
Copy link
Member

@kichik kichik commented Mar 9, 2024

When multiple AMI builders were used in the same stack, the custom resource used to clean up AMIs on delete only had access to delete AMIs for one of the builders.

The error looked like:

Received response status [FAILED] from custom resource. Message returned: You are not authorized to perform this operation. User: arn:aws:sts::0123456789:assumed-role/github-runners-test-deleteamidcc036c8876b451ea2c15-0123456789/github-runners-test-deleteamidcc036c8876b451ea2c15-0123456789 is not authorized to perform: ec2:DeregisterImage on resource: arn:aws:ec2:us-east-1::image/ami-079195c0509e4a902 because no identity-based policy allows the ec2:DeregisterImage action.

Verified

This commit was created on GitHub.com and signed with GitHub’s verified signature.

Verified

This commit was created on GitHub.com and signed with GitHub’s verified signature.
Update snapshot. See details in [workflow run].

[Workflow Run]: https://github.com/CloudSnorkel/cdk-github-runners/actions/runs/8217088468

------

*Automatically created by projen via the "upgrade-snapshot" workflow*
@mergify mergify bot merged commit 4d9c349 into main Mar 9, 2024
12 checks passed
@mergify mergify bot deleted the fix-ami-cleaner branch March 9, 2024 21:00
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants