potiuk opened a new pull request, #79: URL: https://github.com/apache/airflow-ci-infra/pull/79
The apply role may only deploy the RunsOn template versions listed in `terraform/runs-on-access`, so every RunsOn upgrade needed an account admin to apply that module first. The v3.5.1 upgrade (#77) failed at apply with `AccessDenied` on `cloudformation:UpdateStack` for exactly that reason. Changes: - `terraform/runs-on-access`: the apply role's `UpdateStack` condition is `StringLike` on `https://runs-on.s3.eu-west-1.amazonaws.com/cloudformation/template-v*.yaml` instead of `StringEquals` on a version list. Any versioned template RunsOn publishes can be deployed, templates from anywhere else cannot. An upgrade or rollback is then only the `runs_on_version` change, still behind PR review and the `runs-on-prod` approval. - `terraform/runs-on`: `runs_on_version` must match `vX.Y.Z`, so the template URL always falls inside that pattern and a typo fails at plan instead of apply. - READMEs describe the new flow and the one step that still needs an admin: a RunsOn release that adds IAM roles or managed policies fails the stack update until `stack_role_prefixes` (or the managed-policy list) in `terraform/runs-on-access` includes them. - `runs-on.yml.example` matches the job labels again after apache/airflow#75822: size ranges, `spot: co`, and the two in-memory presets with `extras: ["tmpfs"]`. Trade-off: an admin no longer approves each release in IAM, and older published templates become deployable without one. Both still need a merged, reviewed change and the `runs-on-prod` approval. After merge, an account admin applies `terraform/runs-on-access` once (plan: only the `terraform-apply` policy changes). 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
