Update permissions on execution role

awslabs · Nov 12, 2024 · c0a6dd6 · c0a6dd6
1 parent afad1a3
commit c0a6dd6
Showing 1 changed file with 7 additions and 1 deletion.
diff --git a/lib/models/model-api.ts b/lib/models/model-api.ts
@@ -179,7 +179,6 @@ export class ModelsApi extends Construct {
                         new PolicyStatement({
                             effect: Effect.ALLOW,
                             actions: [
-                                'ec2:TerminateInstances',
                                 'ec2:CreateNetworkInterface',
                                 'ec2:DescribeNetworkInterfaces',
                                 'ec2:DescribeSubnets',
@@ -188,6 +187,13 @@ export class ModelsApi extends Construct {
                                 'ec2:UnassignPrivateIpAddresses'
                             ],
                             resources: ['*'],
+                        }),
+                        new PolicyStatement({
+                            effect: Effect.ALLOW,
+                            actions: [
+                                'ec2:TerminateInstances'
+                            ],
+                            resources: ['*'],
                             conditions: {
                                 'StringEquals': {'aws:ResourceTag/lisa_temporary_instance': 'true'}
                             }