fix: Remove "autoscaling:UpdateAutoScalingGroup" permission from cluster-autoscaler IRSA (#357)

blanchardma · web-flow · commit aeb5d7f32267 · 2023-05-05T10:38:11.000-04:00
diff --git a/modules/iam-role-for-service-accounts-eks/policies.tf b/modules/iam-role-for-service-accounts-eks/policies.tf
@@ -74,8 +74,7 @@ data "aws_iam_policy_document" "cluster_autoscaler" {
     content {
       actions = [
         "autoscaling:SetDesiredCapacity",
-        "autoscaling:TerminateInstanceInAutoScalingGroup",
-        "autoscaling:UpdateAutoScalingGroup",
+        "autoscaling:TerminateInstanceInAutoScalingGroup"
       ]
 
       resources = ["*"]

Original file line number	Diff line number	Diff line change
`@@ -74,8 +74,7 @@ data "aws_iam_policy_document" "cluster_autoscaler" {`
`74`	`74`	`content {`
`75`	`75`	`actions = [`
`76`	`76`	`"autoscaling:SetDesiredCapacity",`
`77`		`- "autoscaling:TerminateInstanceInAutoScalingGroup",`
`78`		`- "autoscaling:UpdateAutoScalingGroup",`
	`77`	`+ "autoscaling:TerminateInstanceInAutoScalingGroup"`
`79`	`78`	`]`
`80`	`79`
`81`	`80`	`resources = ["*"]`