How can I use EventBridge to submit a scheduled Batch job without specifying the latest job definition revision?

0

Hello,

I'm trying use EventBridge to schedule Batch submissions. However, I'm getting this error:

"User: arn:aws:sts::[account ID]:assumed-role/[IAM Batch invoker role] is not authorized to perform: batch:SubmitJob on resource: arn:aws:batch:[account ID]:job-definition/[job definition name]"

The invoker role's permissions are as follows:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "batch:SubmitJob",
            "Resource": [
                "arn:aws:batch:[account ID]:job-definition/[job definition name]:*",
                "arn:aws:batch:[account ID]:job/[job name]",
                "arn:aws:batch:[account ID]:job-queue/[job queue name]"
            ]
        }
    ]
}

For whatever reason, the rules work fine if I list the most recent job revision as the rule's target (i.e., arn:aws:batch:[account ID]:job-definition/[job definition name]:235). However, if I don't list the most recent revision number, I get the above error. My team updates this job definition frequently and I'm trying to make several rules like this, so manually changing the revision number every time isn't a good option. The rules also work if I just use "Resource": "*" for permissions, but this security policy is unacceptably broad for my organization. Is there a way I can get rules like this to work without listing the revision number?

gefragt vor einem Jahr465 Aufrufe
1 Antwort
0

Hello!

The job definition value can be one of

  • name,
  • name:revision. Without a revision the latest active revision is used
  • or the ARN for the job definition

Could you try this policy?

"Resource": [ "arn:aws:batch:region:account-number:job-definition/[job definition name]", "arn:aws:batch:region:account-number:job-definition/[job definition name]:*", "arn:aws:batch:region:account-number:job-queue/[job queue name]" ]

profile pictureAWS
beantwortet vor einem Jahr

Du bist nicht angemeldet. Anmelden um eine Antwort zu veröffentlichen.

Eine gute Antwort beantwortet die Frage klar, gibt konstruktives Feedback und fördert die berufliche Weiterentwicklung des Fragenstellers.

Richtlinien für die Beantwortung von Fragen