Merge pull request #232 from tablexi/lp-update_clusterautoscaler_policy

UPDATE cluster autoscaler IAM policy
tablexi · Nov 7, 2023 · 76b94d5 · 76b94d5
2 parents 607620c + 499d96c
commit 76b94d5
Showing 1 changed file with 8 additions and 1 deletion.
diff --git a/aws/eks/main.tf b/aws/eks/main.tf
@@ -266,6 +266,8 @@ data "aws_iam_policy_document" "cluster-autoscaler-trust-relationship" {
   }
 }
 
+# Recommended Policy
+# https://github.com/kubernetes/autoscaler/blob/master/cluster-autoscaler/cloudprovider/aws/README.md#full-cluster-autoscaler-features-policy-recommended
 data "aws_iam_policy_document" "cluster-autoscaler" {
   version = "2012-10-17"
 
@@ -274,10 +276,15 @@ data "aws_iam_policy_document" "cluster-autoscaler" {
       "autoscaling:DescribeAutoScalingGroups",
       "autoscaling:DescribeAutoScalingInstances",
       "autoscaling:DescribeLaunchConfigurations",
+      "autoscaling:DescribeScalingActivities",
       "autoscaling:DescribeTags",
+      "ec2:DescribeInstanceTypes",
+      "ec2:DescribeLaunchTemplateVersions",
       "autoscaling:SetDesiredCapacity",
       "autoscaling:TerminateInstanceInAutoScalingGroup",
-      "ec2:DescribeLaunchTemplateVersions",
+      "ec2:DescribeImages",
+      "ec2:GetInstanceTypesFromInstanceRequirements",
+      "eks:DescribeNodegroup"
     ]
     effect    = "Allow"
     resources = ["*"]