PLAT-2892: Add perms to create service linked role for ASG + bastion …

…eip fix w/ec2 classic (#84) * Add perms for creating ASG service role * Ensure bastion EIP is never an EC2-Classic IP
dominodatalab · Jan 28, 2022 · eaf6ce8 · eaf6ce8
1 parent 87f8baa
commit eaf6ce8
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 0 deletions.
diff --git a/cdk/domino_cdk/config/iam.py b/cdk/domino_cdk/config/iam.py
@@ -80,6 +80,7 @@ def do_cf():
             "iam:CreatePolicy",
             "iam:CreatePolicyVersion",
             "iam:CreateRole",
+            "iam:CreateServiceLinkedRole",
             "iam:DeleteInstanceProfile",
             "iam:DeletePolicy",
             "iam:DeletePolicyVersion",
@@ -100,6 +101,7 @@ def do_cf():
             f"arn:{partition}:iam::{aws_account_id}:policy/{stack_name}-*",
             f"arn:{partition}:iam::{aws_account_id}:role/{stack_name}-*",
             f"arn:{partition}:iam::{aws_account_id}:instance-profile/{stack_name}-*",
+            f"arn:{partition}:iam::{aws_account_id}:role/aws-service-role/autoscaling.amazonaws.com/AWSServiceRoleForAutoScaling",
         ],
     }
 

diff --git a/cdk/domino_cdk/provisioners/vpc.py b/cdk/domino_cdk/provisioners/vpc.py
@@ -254,6 +254,7 @@ def provision_bastion(self, name: str, bastion: config.VPC.Bastion) -> Optional[
         ec2.CfnEIP(
             self.scope,
             "bastion_eip",
+            domain="vpc",
             instance_id=bastion_instance.instance_id,
         )