fix(experimental-ec2-pattern): Create Policy first

.changeset/popular-laws-thank.md

@@ -0,0 +1,15 @@
+---
+"@guardian/cdk": patch
+---
+
+fix(experimental-ec2-pattern): Create Policy first
+
+When deploying Prism with the `GuEc2AppExperimental` for the first time, the deployment failed with the cloud-init-output logs stating:
+
+```log
+An error occurred (AccessDenied) when calling the DescribeTargetHealth operation: User: arn:aws:sts::000000000000:assumed-role/prism-CODE-InstanceRolePrism/i-0cee86d64de253ca4 is not authorized to perform: elasticloadbalancing:DescribeTargetHealth because no identity-based policy allows the elasticloadbalancing:DescribeTargetHealth action
+```
+
+This suggests the instance update was started before the policy was created.
+
+Make the ASG depend on the policy that grants these permissions to resolve, as CloudFormation creates dependencies first.

src/experimental/patterns/__snapshots__/ec2-app.test.ts.snap

@@ -109,6 +109,9 @@ exports[`The GuEc2AppExperimental pattern matches the snapshot 1`] = `
           "Timeout": "PT3M",
         },
       },
+      "DependsOn": [
+        "AsgRollingUpdatePolicy2A1DDC6F",
+      ],
       "Properties": {
         "DesiredCapacity": "1",
         "HealthCheckGracePeriod": 120,

src/experimental/patterns/ec2-app.ts

@@ -1,6 +1,7 @@
 import type { IAspect } from "aws-cdk-lib";
 import { Aspects, CfnParameter, Duration } from "aws-cdk-lib";
 import { CfnAutoScalingGroup, CfnScalingPolicy, ScalingProcess, UpdatePolicy } from "aws-cdk-lib/aws-autoscaling";
+import type { CfnPolicy } from "aws-cdk-lib/aws-iam";
 import { Effect, Policy, PolicyStatement } from "aws-cdk-lib/aws-iam";
 import type { IConstruct } from "constructs";
 import { GuAutoScalingGroup } from "../../constructs/autoscaling";
@@ -308,7 +309,13 @@ export class GuEc2AppExperimental extends GuEc2App {
       },
     };
 
-    AsgRollingUpdatePolicy.getInstance(scope).attachToRole(role);
+    const policy = AsgRollingUpdatePolicy.getInstance(scope);
+    policy.attachToRole(role);
+
+    // Create the Policy with necessary permissions first.
+    // Then create the ASG that requires the permissions.
+    const cfnPolicy = policy.node.defaultChild as CfnPolicy;
+    cfnAutoScalingGroup.addDependency(cfnPolicy);
 
     /*
     `aws` is available via AMIgo baked AMIs.