Ensure that PcfAdminPolicy has ec2:CopyImage permission

[peterellisjones]

When upgrading from PCF 1.12 to 2.0 we encountered an error when deploying the bosh director

creating stemcell (bosh-aws-xen-hvm-ubuntu-trusty-go_agent 3468.21):
  CPI 'create_stemcell' method responded with error: CmdError{"type":"Unknown","message":"You are not authorized to perform this operation.","ok_to_retry":false}

Looking at the CloudTrail logs showed this was caused by the pcf-$FOUNDATION_pcf_iam_user user lacking the ec2:CopyImage IAM permission

I have tested this change in a fork of PCF Pipelines and confirmed that it fixes the error

[cf-gitbot]

We have created an issue in Pivotal Tracker to manage this. Unfortunately, the Pivotal Tracker project is private so you may be unable to view the contents of the story.

The labels on this github issue will be updated when the story is started.

[abbyachau]

Hi @peterellisjones, our pipelines suite does not support minor to minor upgrades (1.12 to 2.0). Could you clarify which pipeline you've used to do the upgrade, what version of the pipelines release, and whether any modifications were made to the pipeline? Thanks.

[peterellisjones]

Hi @abbyachau if you look at the source code for the BOSH AWS CPI you can see that it requires the copy-image permission when creating a new encrypted stemcell:

https://github.com/cloudfoundry-incubator/bosh-aws-cpi-release/blob/733db1cc02c626fdc39dc73eda804d8e0402e5ef/src/bosh_aws_cpi/lib/cloud/aws/cloud.rb#L459-L465

https://github.com/cloudfoundry-incubator/bosh-aws-cpi-release/blob/master/docs/iam-policy.json#L35-L40

We saw this issue when upgrading from a heavily modified 1.12 pipeline with encrypted stemcells (ie encrypted EBS volumes: https://docs.pivotal.io/pivotalcf/1-12/customizing/cloudform-om-ebs-config.html) to a heavily modified 2.0 but anyone who uses encrypted EBS volumes will likely hit this error sooner or later.

By adding the ec2:CopyImage permission to the PcfAdminPolicy you will allow people to use pcf-pipelines to deploy a foundation and then turn on EBS volume encryption without having to make any further modifications to pcf-pipelines

cheers,

Pete

[peterellisjones]

Forgot to mention: the version of pcf-pipelines we're using is 0.23.0 with some of our own commits cherry-picked on top (we regularly rebase when you make a new release)

[abbyachau]

@peterellisjones many thanks. Prioritising for engineering review.