From 745699a020f67231f6a2b4ada9f7dc8067713cd1 Mon Sep 17 00:00:00 2001 From: ejc3 Date: Sun, 25 Oct 2026 12:32:08 +0000 Subject: [PATCH] fcvm-fleet: the coordinator may read the host groups' scaling activities ejc3/fcvm#1263 moves a wake to the on-demand host group as soon as Auto Scaling records a failed spot launch (UnfulfillableCapacity or MaxSpotInstanceCountExceeded, about 10 s after the raise), instead of after --spot-wait (120 s). It reads that from DescribeScalingActivities, which the coordinator's task role lacks; without it the coordinator logs the refusal once and keeps the spot wait. DescribeScalingActivities takes no resource-level permission, so it joins DescribeAutoScalingGroups on Resource "*". scripts/test-fcvm-fleet.py pins the action list. Tested: python3 scripts/test-fcvm-fleet.py (33 tests OK), terraform fmt -check. --- fcvm-fleet.tf | 7 +++++-- scripts/test-fcvm-fleet.py | 2 +- 2 files changed, 6 insertions(+), 3 deletions(-) diff --git a/fcvm-fleet.tf b/fcvm-fleet.tf index e4569122..8a6b79a7 100644 --- a/fcvm-fleet.tf +++ b/fcvm-fleet.tf @@ -564,10 +564,13 @@ resource "aws_iam_role_policy" "fcvm_fleet_coordinator_task" { "arn:aws:autoscaling:${r}:${local.fcvm_fleet_account_id}:autoScalingGroup:*:autoScalingGroupName/${g}"]]) }, { - # Reading the groups' instances while waking. DescribeAutoScalingGroups takes no resource-level permission. + # Reading the groups' instances while they come up, and their scaling activities: a failed spot launch (Auto + # Scaling records UnfulfillableCapacity or MaxSpotInstanceCountExceeded about 10 s after the raise) moves the + # wake to the on-demand group at once instead of after --spot-wait (ejc3/fcvm#1263). Neither Describe takes a + # resource-level permission. Sid = "DescribeTheHostGroups" Effect = "Allow" - Action = "autoscaling:DescribeAutoScalingGroups" + Action = ["autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeScalingActivities"] Resource = "*" }, { diff --git a/scripts/test-fcvm-fleet.py b/scripts/test-fcvm-fleet.py index c140ef10..5b333f00 100644 --- a/scripts/test-fcvm-fleet.py +++ b/scripts/test-fcvm-fleet.py @@ -219,7 +219,7 @@ def test_the_coordinator_scales_only_the_host_groups(self): self.assertIn('[for g in ["fcvm-fleet-hosts", "fcvm-fleet-hosts-on-demand"] :', s) self.assertNotIn('Resource = "*"', s) d = self.stmt("DescribeTheHostGroups") - self.assertIn('Action = "autoscaling:DescribeAutoScalingGroups"', d) + self.assertIn('Action = ["autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeScalingActivities"]', d) self.assertNotRegex(self.TF, r'"autoscaling:\*"') group = block('resource "aws_autoscaling_group" "hosts"', MOD) self.assertIn("ignore_changes = [desired_capacity]", group)