Skip to content

Commit 3c76774

Browse files
LawouachLawouach
committed
switch to builin policies
Signed-off-by: Sylvain Hellegouarch <[email protected]>
1 parent a5891e3 commit 3c76774

File tree

2 files changed

+18
-116
lines changed

2 files changed

+18
-116
lines changed

‎CHANGELOG.md

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,11 @@
1212

1313
Allow no tags in `start_availability_zone_power_interruption_scenario`
1414

15+
### Changed
16+
17+
- Use existing AWS FIS policies `AWSFaultInjectionSimulatorNetworkAccess`,
18+
`AWSFaultInjectionSimulatorEC2Access` instead of creating new ones
19+
1520
## [0.31.0][] - 2024-01-21
1621

1722
[0.31.0]: https://github.com/chaostoolkit-incubator/chaostoolkit-aws/compare/0.30.0...0.31.0

‎chaosaws/fis/actions.py

Lines changed: 13 additions & 116 deletions
Original file line numberDiff line numberDiff line change
@@ -527,7 +527,10 @@ def start_availability_zone_power_interruption_scenario(
527527
role_arn = response["Role"]["Arn"]
528528
logger.debug(f"FIS Role created: {role_arn}")
529529

530-
target_region, _ = az.rsplit("-", 1)
530+
a, b, c = az.split("-", 2)
531+
target_region = f"{a}-{b}-{c[0]}"
532+
logger.debug(f"Target AZ {az}")
533+
logger.debug(f"Target region {target_region}")
531534

532535
if create_console_ebsvolume_policy:
533536
response = iam_client.create_policy(
@@ -560,40 +563,9 @@ def start_availability_zone_power_interruption_scenario(
560563
)
561564

562565
if create_console_ec2_policy:
563-
response = iam_client.create_policy(
564-
PolicyName=f"FIS-Console-EC2-{suffix}",
565-
PolicyDocument=json.dumps(
566-
{
567-
"Version": "2012-10-17",
568-
"Statement": [
569-
{
570-
"Sid": "AllowFISExperimentRoleEC2Actions",
571-
"Effect": "Allow",
572-
"Action": [
573-
"ec2:RebootInstances",
574-
"ec2:StopInstances",
575-
"ec2:StartInstances",
576-
"ec2:TerminateInstances",
577-
],
578-
"Resource": f"arn:aws:ec2:{target_region}:{account_id}:instance/*",
579-
},
580-
{
581-
"Sid": "AllowFISExperimentRoleSpotInstanceActions",
582-
"Effect": "Allow",
583-
"Action": ["ec2:SendSpotInstanceInterruptions"],
584-
"Resource": f"arn:aws:ec2:{target_region}:{account_id}:instance/*",
585-
},
586-
],
587-
}
588-
),
589-
Tags=tags_as_kv,
590-
)
591-
592-
policy_arn = response["Policy"]["Arn"]
593-
logger.debug(f"Role policy created: {policy_arn}")
594-
595566
response = iam_client.attach_role_policy(
596-
RoleName=role_name, PolicyArn=policy_arn
567+
RoleName=role_name,
568+
PolicyArn="arn:aws:iam::aws:policy/service-role/AWSFaultInjectionSimulatorEC2Access",
597569
)
598570

599571
response = iam_client.create_policy(
@@ -673,88 +645,9 @@ def start_availability_zone_power_interruption_scenario(
673645
)
674646

675647
if create_console_network_policy:
676-
response = iam_client.create_policy(
677-
PolicyName=f"FIS-Console-Network-{suffix}",
678-
PolicyDocument=json.dumps(
679-
{
680-
"Version": "2012-10-17",
681-
"Statement": [
682-
{
683-
"Effect": "Allow",
684-
"Action": "ec2:CreateTags",
685-
"Resource": "arn:aws:ec2:*:*:network-acl/*",
686-
"Condition": {
687-
"StringEquals": {
688-
"ec2:CreateAction": "CreateNetworkAcl",
689-
"aws:RequestTag/managedByFIS": "true",
690-
}
691-
},
692-
},
693-
{
694-
"Effect": "Allow",
695-
"Action": "ec2:CreateNetworkAcl",
696-
"Resource": "arn:aws:ec2:*:*:network-acl/*",
697-
"Condition": {
698-
"StringEquals": {
699-
"aws:RequestTag/managedByFIS": "true"
700-
}
701-
},
702-
},
703-
{
704-
"Effect": "Allow",
705-
"Action": [
706-
"ec2:CreateNetworkAclEntry",
707-
"ec2:DeleteNetworkAcl",
708-
],
709-
"Resource": [
710-
"arn:aws:ec2:*:*:network-acl/*",
711-
"arn:aws:ec2:*:*:vpc/*",
712-
],
713-
"Condition": {
714-
"StringEquals": {
715-
"ec2:ResourceTag/managedByFIS": "true"
716-
}
717-
},
718-
},
719-
{
720-
"Effect": "Allow",
721-
"Action": "ec2:CreateNetworkAcl",
722-
"Resource": "arn:aws:ec2:*:*:vpc/*",
723-
},
724-
{
725-
"Effect": "Allow",
726-
"Action": [
727-
"ec2:DescribeVpcs",
728-
"ec2:DescribeManagedPrefixLists",
729-
"ec2:DescribeSubnets",
730-
"ec2:DescribeNetworkAcls",
731-
],
732-
"Resource": "*",
733-
},
734-
{
735-
"Effect": "Allow",
736-
"Action": "ec2:ReplaceNetworkAclAssociation",
737-
"Resource": [
738-
"arn:aws:ec2:*:*:subnet/*",
739-
"arn:aws:ec2:*:*:network-acl/*",
740-
],
741-
},
742-
{
743-
"Effect": "Allow",
744-
"Action": "ec2:GetManagedPrefixListEntries",
745-
"Resource": "arn:aws:ec2:*:*:prefix-list/*",
746-
},
747-
],
748-
}
749-
),
750-
Tags=tags_as_kv,
751-
)
752-
753-
policy_arn = response["Policy"]["Arn"]
754-
logger.debug(f"Role policy created: {policy_arn}")
755-
756648
response = iam_client.attach_role_policy(
757-
RoleName=role_name, PolicyArn=policy_arn
649+
RoleName=role_name,
650+
PolicyArn="arn:aws:iam::aws:policy/service-role/AWSFaultInjectionSimulatorNetworkAccess",
758651
)
759652

760653
if enable_rds_policy:
@@ -884,7 +777,11 @@ def restore_availability_zone_power_after_interruption(
884777
for policy in policies:
885778
policy_name = policy["PolicyName"]
886779
# don't delete managed policies
887-
if policy_name in ["AWSFaultInjectionSimulatorRDSAccess"]:
780+
if policy_name in [
781+
"AWSFaultInjectionSimulatorRDSAccess",
782+
"AWSFaultInjectionSimulatorNetworkAccess",
783+
"AWSFaultInjectionSimulatorEC2Access",
784+
]:
888785
continue
889786

890787
logger.debug(f"Deleting policy {policy_name}")

0 commit comments

Comments
 (0)