Skip to content

Add notification for SCP Deny Worker Node in HCP #365

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Add notification for SCP Deny Worker Node in HCP #365

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 8 additions & 0 deletions hcp/hcp_aws_scp_permissions_blocking_node_provision_issue.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,8 @@
{
"severity": "Critical",
"service_name": "SREManualAction",
"log_type": "cluster-lifecycle",
"summary": "Worker node provisioning, action required",
"description": "Your cluster's worker nodes are unable to provision because the required permission to perform 'ec2:RunInstances' is explicitly denied by an AWS Organizations service control policy. To resolve this issue, review and update the relevant service control policies to allow the necessary permissions for instance creation. This is currently impacting your cluster's ability to upgrade, and without action, your cluster's SLA may be impacted. ",
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

  • We should add a comma before "because" (s/provision because/provision, because/).
  • Should ec2:RunInstances be a parameter? I assume the SCP could block a number of things.
  • Do you think it would benefit to include a reference to the CloudTrail event that led us to this conclusion? Thinking from the customer's perspective, having the exact event would help me fix the issue and find others that may arise.

"internal_only": false
}