Skip to content

feat:[PEA-358] Allow k8s lambda to assume 'ro' role #2399

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
kevin-paladin wants to merge 1 commit into from
Closed

feat:[PEA-358] Allow k8s lambda to assume 'ro' role #2399

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 4 additions & 1 deletion installer/resources/iam/all_read_role.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,10 @@ class LambdaPolicyDocument(iam.IAMPolicyDocumentData):
'actions': ["sts:AssumeRole"],
'principals': {
'type': "AWS",
'identifiers': [ECSRole.get_output_attr('arn')]
'identifiers': [
ECSRole.get_output_attr('arn'),
"arn:aws:iam::" + Settings.ACCOUNT_ID + ":role/" + Settings.STACK_ENV + "-svc-plugin-k8s-containers-role"

@coderabbitai coderabbitai Bot Jul 2, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🩺 Stability & Availability | 🔴 Critical | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Locate the canonical Settings definition/import pattern, then add the matching import
# to installer/resources/iam/all_read_role.py.
rg -n --type py -C2 'class Settings\b|Settings\s*=' .
rg -n --type py -C2 'from .* import .*Settings|import .*Settings' .

Repository: PaladinCloud/CE

Length of output: 29629

🏁 Script executed:

#!/bin/bash
set -euo pipefail

# Inspect the target file and the closest matching IAM resource for import patterns.
sed -n '1,120p' installer/resources/iam/all_read_role.py
printf '\n--- base_role.py ---\n'
sed -n '1,80p' installer/resources/iam/base_role.py
printf '\n--- ecs_role.py ---\n'
sed -n '1,80p' installer/resources/iam/ecs_role.py

# Show exact references to Settings in the target file, if any.
printf '\n--- Settings refs in all_read_role.py ---\n'
rg -n 'Settings|ECSRole|principals|identifiers' installer/resources/iam/all_read_role.py

Repository: PaladinCloud/CE

Length of output: 9701

🏁 Script executed:

#!/bin/bash
set -euo pipefail

# Read the reviewed file and dependency files to determine whether Settings is imported.
for f in installer/resources/iam/all_read_role.py installer/resources/iam/base_role.py installer/resources/iam/ecs_role.py; do
  echo "--- $f ---"
  cat -n "$f"
  echo
done

# Check whether the target file imports Settings directly or via wildcard.
echo "--- import lines in all_read_role.py ---"
rg -n '^(from|import) ' installer/resources/iam/all_read_role.py

Repository: PaladinCloud/CE

Length of output: 15408

Import Settings before using it here.

Settings.ACCOUNT_ID and Settings.STACK_ENV are referenced without a module-level import, so this class body will raise NameError during import and block policy generation.

🧰 Tools
🪛 Ruff (0.15.20)

[error] 13-13: Undefined name Settings

(F821)

[error] 13-13: Undefined name Settings

(F821)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@installer/resources/iam/all_read_role.py` at line 13, The role ARN assembly
in the class body references Settings.ACCOUNT_ID and Settings.STACK_ENV before
Settings is imported, which will cause a NameError during module load. Add the
missing module-level import for Settings in all_read_role.py before the class
definition that builds the ARN, and keep the reference in the policy string
unchanged so policy generation can complete.

Source: Linters/SAST tools

]
}
}
]
Expand Down
Loading