Page MenuHomePhabricator
Files F2837950

D11158.diff
No OneTemporary
Actions

D11158.diff
View Options

diff --git a/services/terraform/remote/aws_iam.tf b/services/terraform/remote/aws_iam.tf
--- a/services/terraform/remote/aws_iam.tf
+++ b/services/terraform/remote/aws_iam.tf
@@ -319,3 +319,53 @@
domain_name = module.shared.opensearch_domain_identity.domain_name
access_policies = data.aws_iam_policy_document.opensearch_domain_access.json
}
+
+resource "aws_iam_role" "scheduler" {
+ name = "cron-scheduler-role"
+ assume_role_policy = jsonencode({
+ Version = "2012-10-17"
+ Statement = [
+ {
+ Effect = "Allow"
+ Principal = {
+ Service = ["scheduler.amazonaws.com"]
+ }
+ Action = "sts:AssumeRole"
+ }
+ ]
+ })
+}
+
+resource "aws_iam_role_policy_attachment" "scheduler" {
+ policy_arn = aws_iam_policy.scheduler.arn
+ role = aws_iam_role.scheduler.name
+}
+
+resource "aws_iam_policy" "scheduler" {
+ name = "cron-scheduler-policy"
+ policy = jsonencode({
+ Version = "2012-10-17"
+ Statement = [
+ # Allow scheduler to execute the task
+ {
+
+ Effect = "Allow",
+ Action = [
+ "ecs:RunTask"
+ ]
+ Resource = aws_ecs_task_definition.blob_cleanup.arn_without_revision
+ },
+ # Allow scheduler to set the IAM roles of the ECS task
+ {
+ Effect = "Allow",
+ Action = [
+ "iam:PassRole"
+ ]
+ Resource = [
+ aws_ecs_task_definition.blob_cleanup.execution_role_arn,
+ aws_ecs_task_definition.blob_cleanup.task_role_arn
+ ]
+ },
+ ]
+ })
+}
diff --git a/services/terraform/remote/task_blob_cleanup.tf b/services/terraform/remote/task_blob_cleanup.tf
--- a/services/terraform/remote/task_blob_cleanup.tf
+++ b/services/terraform/remote/task_blob_cleanup.tf
@@ -80,53 +80,3 @@
}
}
}
-
-resource "aws_iam_role" "scheduler" {
- name = "cron-scheduler-role"
- assume_role_policy = jsonencode({
- Version = "2012-10-17"
- Statement = [
- {
- Effect = "Allow"
- Principal = {
- Service = ["scheduler.amazonaws.com"]
- }
- Action = "sts:AssumeRole"
- }
- ]
- })
-}
-
-resource "aws_iam_role_policy_attachment" "scheduler" {
- policy_arn = aws_iam_policy.scheduler.arn
- role = aws_iam_role.scheduler.name
-}
-
-resource "aws_iam_policy" "scheduler" {
- name = "cron-scheduler-policy"
- policy = jsonencode({
- Version = "2012-10-17"
- Statement = [
- # Allow scheduler to execute the task
- {
-
- Effect = "Allow",
- Action = [
- "ecs:RunTask"
- ]
- Resource = aws_ecs_task_definition.blob_cleanup.arn_without_revision
- },
- # Allow scheduler to set the IAM roles of the ECS task
- {
- Effect = "Allow",
- Action = [
- "iam:PassRole"
- ]
- Resource = [
- aws_ecs_task_definition.blob_cleanup.execution_role_arn,
- aws_ecs_task_definition.blob_cleanup.task_role_arn
- ]
- },
- ]
- })
-}

File Metadata

Mime Type
text/plain
Expires
Sun, Sep 29, 8:26 PM (22 h, 3 m)
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
2202550
Default Alt Text
D11158.diff (2 KB)

Event Timeline