Repository navigation
idle-shutdown: wake Lambda IAM policy limits ec2:DescribeInstanceStatus to one instance ARN #129
Description
In install-idle.sh L236-237 the wake Lambda policy is:
{"Effect":"Allow","Action":["ec2:StartInstances","ec2:DescribeInstanceStatus"],
"Resource":"arn:aws:ec2:${REGION}:${ACCT_ID}:instance/${INSTANCE_ID}"}Problem: EC2 Describe* actions do not support resource-level permissions. They match only "Resource": "*". The call at wake-lambda/index.mjs L82 then gets AccessDenied, and the handler goes to its error path (L87). The wake link can fail before it starts the instance.
Fix: Put ec2:DescribeInstanceStatus in a separate statement with "Resource": "*". Keep ec2:StartInstances limited to the instance ARN.
Found by a code read at commit 1e50295. The code was read, but not run on a real instance.
Activity
royosherove commentedon Oct 11, 2026
👻 Drew is on this · Kiro Crew Issue Radar
awaiting-merge · PR #139 · updated 12:37 UTC
Finding: The report is correct. In
bootstraps/optional/idle-shutdown/install-idle.sh(lines 235-238 at1e50295), the wake Lambda inline policy givesec2:DescribeInstanceStatusonly on the instance ARN. EC2Describe*actions do not support resource-level permissions, so they match only"Resource": "*". Thus the call inwake-lambda/index.mjsline 82 gets AccessDenied and the handler goes to its error path (line 87) beforeStartInstances(line 110). The notify Lambda policy in the same file (line 221) already uses"Resource": "*"for its Describe actions. No open or closed PR changes this policy (open PRs #71, #125, #126 do not touchinstall-idle.sh).Fix (PR #138):
ec2:DescribeInstanceStatusis now in its own statement with"Resource": "*".ec2:StartInstancesstays limited to the instance ARN. The new testtests/test-idle-wake-policy.shreads the policy from the script and checks both statements. It fails onmain(1 of 6 checks) and passes with the fix (6 of 6). Existing installs get the new policy wheninstall-idle.shruns again. I did not run the installer against a real AWS account. PR #138 is merged. A Codex review on #138 found that the test accepted anyec2:Describe*action; that test fix is in follow-up PR #139, because #138 merged before the commit was pushed.progress
12:26claimed -- read the wake policy, the wake Lambda call sites and the open PRs12:27branchcrew/drew/issue-129-- policy split plus a regression test that fails first12:28opened PR fix(idle-shutdown): give DescribeInstanceStatus Resource * in wake policy #138 -- CI running12:33CI 20/20 green; PR fix(idle-shutdown): give DescribeInstanceStatus Resource * in wake policy #138 merged12:37opened follow-up PR test(idle-shutdown): check DescribeInstanceStatus by exact name #139 -- test checks the exact action name (Codex finding on fix(idle-shutdown): give DescribeInstanceStatus Resource * in wake policy #138)fix(idle-shutdown): give DescribeInstanceStatus Resource * in the wak…