How can I use EventBridge to submit a scheduled Batch job without specifying the latest job definition revision?

0

Hello,

I'm trying use EventBridge to schedule Batch submissions. However, I'm getting this error:

"User: arn:aws:sts::[account ID]:assumed-role/[IAM Batch invoker role] is not authorized to perform: batch:SubmitJob on resource: arn:aws:batch:[account ID]:job-definition/[job definition name]"

The invoker role's permissions are as follows:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "batch:SubmitJob",
            "Resource": [
                "arn:aws:batch:[account ID]:job-definition/[job definition name]:*",
                "arn:aws:batch:[account ID]:job/[job name]",
                "arn:aws:batch:[account ID]:job-queue/[job queue name]"
            ]
        }
    ]
}

For whatever reason, the rules work fine if I list the most recent job revision as the rule's target (i.e., arn:aws:batch:[account ID]:job-definition/[job definition name]:235). However, if I don't list the most recent revision number, I get the above error. My team updates this job definition frequently and I'm trying to make several rules like this, so manually changing the revision number every time isn't a good option. The rules also work if I just use "Resource": "*" for permissions, but this security policy is unacceptably broad for my organization. Is there a way I can get rules like this to work without listing the revision number?

已提问 1 年前465 查看次数
1 回答
0

Hello!

The job definition value can be one of

  • name,
  • name:revision. Without a revision the latest active revision is used
  • or the ARN for the job definition

Could you try this policy?

"Resource": [ "arn:aws:batch:region:account-number:job-definition/[job definition name]", "arn:aws:batch:region:account-number:job-definition/[job definition name]:*", "arn:aws:batch:region:account-number:job-queue/[job queue name]" ]

profile pictureAWS
已回答 1 年前

您未登录。 登录 发布回答。

一个好的回答可以清楚地解答问题和提供建设性反馈,并能促进提问者的职业发展。

回答问题的准则