Allow instances to kill themselves via ASG custom health check

getndazn · Jul 8, 2020 · 3a55d5a · 3a55d5a
1 parent b20f4c3
commit 3a55d5a
Show file tree

Hide file tree

Showing 2 changed files with 15 additions and 0 deletions.
diff --git a/CHANGELOG/2020-07-08-PLAT-4678_perms-for-set-instance-health.yml b/CHANGELOG/2020-07-08-PLAT-4678_perms-for-set-instance-health.yml
@@ -0,0 +1,4 @@
+- type: added
+  m: Allow instances to set themselves as unhealthy so that Autoscaling can kill them.
+  jira: PLAT-4678
+  owner: tomnorth
diff --git a/iam_child.tf b/iam_child.tf
@@ -56,6 +56,17 @@ data "aws_iam_policy_document" "bastion_service_assume_role_in_parent" {
       var.assume_role_arn,
     ]
   }
+
+  # Allow instances to mark themselves unhealthy
+  statement {
+    effect = "Allow"
+
+    actions = [
+      "autoscaling:SetInstanceHealth"
+    ]
+
+    resources = ["*"]
+  }
 }
 
 resource "aws_iam_policy" "bastion_service_assume_role_in_parent" {