Skip to content

fix: allow DescribeLifecycleHooks for monitor_runner.sh - #1386

Open
uosjead wants to merge 1 commit into
cattle-ops:mainfrom
uosjead:fix/describe-lifecycle-hooks
Open

fix: allow DescribeLifecycleHooks for monitor_runner.sh#1386
uosjead wants to merge 1 commit into
cattle-ops:mainfrom
uosjead:fix/describe-lifecycle-hooks

Conversation

@uosjead

@uosjead uosjead commented Jul 28, 2026

Copy link
Copy Markdown
Contributor

Move autoscaling:DescribeLifecycleHooks to Resource "*" (describe APIs do not support resource-level permissions) and scope CompleteLifecycleAction to the Runner Manager ASG that the script actually targets, instead of the worker autoscaler ASG.

Description

fixes an error with the graceful shutdown permissions - noticed in logs prevents graceful shutdown from finishing

An error occurred (AccessDenied) when calling the DescribeLifecycleHooks operation: User: arn:aws:sts::123456789:assumed-role/example-instance/i-XXXXXXXXXX is not authorized to perform: autoscaling:DescribeLifecycleHooks because no identity-based policy allows the autoscaling:DescribeLifecycleHooks action

Migrations required

No

Verification

Not done.

@uosjead
uosjead requested review from kayman-mk and npalm as code owners July 28, 2026 15:17
@github-actions

Copy link
Copy Markdown
Contributor

Hey @uosjead! 👋

Thank you for your contribution to the project. Please refer to the contribution rules for a quick overview of the process.

Make sure that this PR clearly explains:

  • the problem being solved
  • the best way a reviewer and you can test your changes

With submitting this PR you confirm that you hold the rights of the code added and agree that it will published under this LICENSE.

The following ChatOps commands are supported:

  • /help: notifies a maintainer to help you out

Simply add a comment with the command in the first line. If you need to pass more information, separate it with a blank line from the command.

This message was generated automatically. You are welcome to improve it.

Move autoscaling:DescribeLifecycleHooks to Resource "*" (describe
APIs do not support resource-level permissions) and scope
CompleteLifecycleAction to the Runner Manager ASG that the script
actually targets, instead of the worker autoscaler ASG.

Co-authored-by: Cursor <cursoragent@cursor.com>
@uosjead
uosjead force-pushed the fix/describe-lifecycle-hooks branch from 59decca to b72aea5 Compare July 28, 2026 15:23
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant