NVIDIA / holodeck / 37519464677

53%

main: 50%

push

github

fix(aws): fall back to AWS zone placement without zone discovery permissions

The availability zone pre-flight calls DescribeAvailabilityZones and
DescribeInstanceTypeOfferings. An identity without the
ec2:DescribeAvailabilityZones or ec2:DescribeInstanceTypeOfferings
permission gets UnauthorizedOperation from those calls, which aborted the
pre-flight, so callers that could create environments before the zone
selection change could no longer create anything. The real-AWS CI user is
one of them.

When either call fails with UnauthorizedOperation and no availabilityZone
is set, the pre-flight now logs a warning naming both permissions and
leaves the zone unselected, and createSubnet and createPublicSubnet omit
AvailabilityZone so that AWS chooses it as before. The region-level
instance type check still runs, and dryrun behaves the same way. If
availabilityZone is set, the pre-flight fails instead, because the
requested zone cannot be validated without those permissions. Any other
error from the zone discovery calls still fails the pre-flight.

The subnet functions still refuse an empty zone unless the pre-flight
recorded this fallback, so a path that skips the pre-flight cannot
silently let AWS pick the zone. The error code is read through the
ErrorCode method that smithy.APIError defines, which keeps smithy-go an
indirect dependency.

The prerequisites page lists the two permissions as recommended and
describes what happens without them.

Signed-off-by: Abrar Shivani <ashivani@nvidia.com>

34 of 34 new or added lines in 2 files covered. (100.0%)

7122 of 13384 relevant lines covered (53.21%)

0.59 hits per line