Repository navigation
chore(iac/aws): scope the fck-nat instance role's ModifyNetworkInterfaceAttribute to its own ENIs #1763
Description
The fck-nat instance role (terraform/modules/networking/aws/main.tf, the inline policy on the NAT instance role) grants ec2:ModifyNetworkInterfaceAttribute with Resource = "*". This predates #1090.
Change
Narrow the grant to the two interfaces fck-nat actually modifies:
- The instance's primary ENI. Tag it through the launch template's
tag_specifications { resource_type = "network-interface" }, and condition the grant on that tag (ec2:ResourceTag/<key>).RaJiska/terraform-aws-fck-natscopes it the same way. - The persistent ENI from fix(iac/aws): route private egress through a persistent fck-nat ENI #1090. Scope it by ARN.
Verify that the source/dest-check change on the primary ENI still succeeds. Upstream fck-nat.sh ignores that call's failure, so a wrong condition would break return traffic without an error. Add a terraform test assertion on the policy's resource and condition, plus a mutation probe.
Related
An alarm on NAT instance churn on the fck-nat ASG (nat_autoscaling_group_name). After #1090, a persistent ENI-attach failure replaces one instance about every 5 minutes. There's no shared alarm notification target in the AWS environment today, so this needs one, or reuses an existing per-module alarm pattern.
From the #1090 reviews (cc-libs, darling).
Activity
[-]sec(iac/aws): scope the fck-nat instance role's ModifyNetworkInterfaceAttribute to its own ENIs[/-][+]chore(iac/aws): scope the fck-nat instance role's ModifyNetworkInterfaceAttribute to its own ENIs[/+]cristim commentedon Nov 5, 2026
Claimed by claude-darling: the ModifyNetworkInterfaceAttribute scoping (the primary ENI tagged via the launch template's tag_specifications and the grant conditioned on that tag; the #1090 persistent ENI by ARN), with a tftest on resource and condition plus mutation probes. Local commits; tests run on my next heavy-4 slot; the PR opens when a platform slot frees. The NAT-churn alarm in 'Related' is not in this claim: it needs a notification target decision and stays open.
fix(networking): drop the unused persistent-ENI ModifyNetworkInterfac…
chore(iac/aws): scope the fck-nat role's ModifyNetworkInterfaceAttrib…
cristim commentedon Nov 10, 2026
Premise check by claude-darling (no new code needed): the scoping this issue asks for is already on main via PR #1813 (d459a8b). Verified against main, terraform/modules/networking/aws/main.tf: (1) the launch template tags the primary ENI through a network-interface tag_specifications block (l.~305-310) with Name = local.fck_nat_primary_eni_name; (2) the instance role's DisableSourceDestCheckPrimaryENI statement (l.~398-407) grants ec2:ModifyNetworkInterfaceAttribute only on the account's network-interface/* ARN conditioned on StringEquals ec2:ResourceTag/Name = the SAME local, so the tag and the condition cannot drift apart; (3) the instance role has no ec2:CreateTags (git grep finds none in the module), so a compromised NAT instance cannot tag another interface with that Name to widen the grant; (4) the persistent ENI (#1090) needs no instance grant at all: Terraform creates it with source_dest_check = false and the upstream fck-nat.sh modifies only the primary (outbound) ENI, so that statement was dropped instead of scoped by ARN (a deviation from the issue text that is stricter, not looser); (5) tests: terraform/modules/networking/aws/tests/fck_nat_eni.tftest.hcl (run modify_eni_attribute_is_scoped) and the PR's mutation probes. Residual caveat: the condition matches on the Name tag value, so any other principal in the account that can create tags and attach that name could also be matched by this grant only if it holds the NAT role, which it cannot assume; unrelated ENIs named differently are out of reach. What is still open in this issue is only the 'Related' NAT-churn alarm, which needs a notification-target decision (there is no shared alarm target in the AWS environment); I am not starting it without that decision.
cristim commentedon Nov 10, 2026
Claimed by claude-darling (coordinator assignment): the remaining NAT-churn alarm only. Reusing the monitoring module's SNS topic (option B: an optional alarm_sns_topic_arns list on the networking module per the Lambda convention, opt-in and off by default, wired in the AWS environment behind its own flag); direct commits to main after a 2-pass review.
cristim commentedon Nov 12, 2026
Checked on origin/main 447a98b. Partly met, leaving open.
Met: ModifyNetworkInterfaceAttribute is scoped. terraform/modules/networking/aws/main.tf:398-406 grants it on network-interface/* conditioned on ec2:ResourceTag/Name equal to the launch template's network-interface tag (tag_specifications at main.tf:305). The persistent ENI needs no grant (source_dest_check = false is set by Terraform). Test: tests/fck_nat_eni.tftest.hcl run modify_eni_attribute_is_scoped (:155-198). Landed in d459a8b (#1813).
Still open: the "Related" alarm on NAT instance churn on the fck-nat ASG. No aws_cloudwatch_metric_alarm exists in terraform/modules/networking (only the ASG-name output for it at outputs.tf:129), and no alarm notification target is wired for it.
chore(iac/aws): grant the deploy role ASG metrics collection for the …
feat(iac/aws): add an opt-in NAT ASG group metric to the networking m…