Merge pull request #2163 from ConnorJC3/update-policy

Update example policy for IAM change
kubernetes-sigs · Oct 2, 2024 · 1f52666 · 1f52666
2 parents 945321b + 34ddb93
commit 1f52666
Show file tree

Hide file tree

Showing 2 changed files with 13 additions and 11 deletions.
diff --git a/docs/example-iam-policy.json b/docs/example-iam-policy.json
@@ -42,7 +42,7 @@
       "Action": [
         "ec2:CreateVolume"
       ],
-      "Resource": "*",
+      "Resource": "arn:aws:ec2:*:*:volume/*",
       "Condition": {
         "StringLike": {
           "aws:RequestTag/ebs.csi.aws.com/cluster": "true"
@@ -54,13 +54,20 @@
       "Action": [
         "ec2:CreateVolume"
       ],
-      "Resource": "*",
+      "Resource": "arn:aws:ec2:*:*:volume/*",
       "Condition": {
         "StringLike": {
           "aws:RequestTag/CSIVolumeName": "*"
         }
       }
     },
+    {
+      "Effect": "Allow",
+      "Action": [
+        "ec2:CreateVolume"
+      ],
+      "Resource": "arn:aws:ec2:*:*:snapshot/*"
+    },
     {
       "Effect": "Allow",
       "Action": [

diff --git a/hack/e2e/kops/patch-cluster.yaml b/hack/e2e/kops/patch-cluster.yaml
@@ -66,7 +66,7 @@ spec:
           "Action": [
             "ec2:CreateVolume"
           ],
-          "Resource": "*",
+          "Resource": "arn:aws:ec2:*:*:volume/*",
           "Condition": {
             "StringLike": {
               "aws:RequestTag/ebs.csi.aws.com/cluster": "true"
@@ -78,7 +78,7 @@ spec:
           "Action": [
             "ec2:CreateVolume"
           ],
-          "Resource": "*",
+          "Resource": "arn:aws:ec2:*:*:volume/*",
           "Condition": {
             "StringLike": {
               "aws:RequestTag/CSIVolumeName": "*"
@@ -90,12 +90,7 @@ spec:
           "Action": [
             "ec2:CreateVolume"
           ],
-          "Resource": "*",
-          "Condition": {
-            "StringLike": {
-              "aws:RequestTag/kubernetes.io/cluster/*": "owned"
-            }
-          }
+          "Resource": "arn:aws:ec2:*:*:snapshot/*"
         },
         {
           "Effect": "Allow",
@@ -129,7 +124,7 @@ spec:
           "Resource": "*",
           "Condition": {
             "StringLike": {
-              "ec2:ResourceTag/kubernetes.io/cluster/*": "owned"
+              "ec2:ResourceTag/kubernetes.io/created-for/pvc/name": "*"
             }
           }
         },