ec2:DescribeTags missing from permission breaks monitor_runner.sh

[rk295]

Describe the bug

When using the docker autoscaler a script /opt/monitor_runner.sh is deployed which uses aws ec2 describe-tags to list the tags on the auto scaling group. The policy which is attached to the instance running the script lacks the required permission.

The legacy docker machine policy had ec2:Describe* so I think this might be a miss when adding the new auto scaler.

To Reproduce

Steps to reproduce the behavior:

1. Deploy examples/runner-fleeting-plugin
2. Check the logs on the master instance to see the AWS 403 because the runner lacks ec2:DescribeTags whenever monitor_runner.sh is executed.

Expected behavior

The provided monitor_runner.sh script should execute in the default configuration without errors.

[kayman-mk]

Could you please give me a hint where the /opt/monitor_runner.sh is coming from and how it looks like?

[rk295]

Could you please give me a hint where the /opt/monitor_runner.sh is coming from and how it looks like?

Sure thing, its here in the gitlab-runner.tftpl file. Line 19 of the script, line 339 of the template.