Add CAPA permissions for ASG lifecycle hooks (#128)

giantswarm · Nov 25, 2024 · 76b9557 · 76b9557
1 parent 4050ff3
commit 76b9557
Show file tree

Hide file tree

Showing 3 changed files with 7 additions and 0 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -11,6 +11,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 - Add support for removing some IAM permissions from the capa controller role in BYOVPC installations.
 - CAPA role CloudFormation template: switch from inline to managed policies for the CAPA IAM role.
+- Add CAPA permissions for ASG lifecycle hooks
 
 ## [4.2.0] - 2024-09-04
 

diff --git a/capa-controller-role/capa-controller-policy.json b/capa-controller-role/capa-controller-policy.json
@@ -46,6 +46,9 @@
                 "autoscaling:SuspendProcesses",
                 "autoscaling:DescribeAutoScalingInstances",
                 "autoscaling:TerminateInstanceInAutoScalingGroup",
+                "autoscaling:DeleteLifecycleHook",
+                "autoscaling:DescribeLifecycleHooks",
+                "autoscaling:PutLifecycleHook",
                 "ec2:CreateLaunchTemplate",
                 "ec2:CreateLaunchTemplateVersion",
                 "ec2:DescribeLaunchTemplates",

diff --git a/capa-controller-role/cloud-formation-template.yaml b/capa-controller-role/cloud-formation-template.yaml
@@ -111,6 +111,9 @@ Resources:
               - "autoscaling:SuspendProcesses"
               - "autoscaling:DescribeAutoScalingInstances"
               - "autoscaling:TerminateInstanceInAutoScalingGroup"
+              - "autoscaling:DeleteLifecycleHook"
+              - "autoscaling:DescribeLifecycleHooks"
+              - "autoscaling:PutLifecycleHook"
               - "ec2:CreateLaunchTemplate"
               - "ec2:CreateLaunchTemplateVersion"
               - "ec2:DescribeLaunchTemplates"