Skip to content

Commit

Permalink
[WIP] Update IAM policy
Browse files Browse the repository at this point in the history 
Signed-off-by: Connor Catlett <[email protected]>
  • Loading branch information
@ConnorJC3
ConnorJC3 committed Nov 14, 2024
1 parent de6e80e commit 82d86cd
Show file tree
Hide file tree
Showing 2 changed files with 91 additions and 106 deletions.
99 changes: 45 additions & 54 deletions docs/example-iam-policy.json
View file
Original file line number Diff line number Diff line change
Expand Up @@ -4,61 +4,59 @@
{
"Effect": "Allow",
"Action": [
"ec2:CreateSnapshot",
"ec2:AttachVolume",
"ec2:DetachVolume",
"ec2:ModifyVolume",
"ec2:DescribeAvailabilityZones",
"ec2:DescribeInstances",
"ec2:DescribeSnapshots",
"ec2:DescribeTags",
"ec2:DescribeVolumes",
"ec2:DescribeVolumesModifications",
"ec2:EnableFastSnapshotRestores"
"ec2:DescribeVolumesModifications"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"ec2:CreateTags"
"ec2:AttachVolume",
"ec2:DetachVolume",
"ec2:ModifyVolume",
"ec2:CreateSnapshot"
],
"Resource": [
"arn:*:ec2:*:*:volume/*",
"arn:*:ec2:*:*:snapshot/*"
]
"Resource": "arn:aws:ec2:*:*:volume/*"
},
{
"Effect": "Allow",
"Action": [
"ec2:DeleteTags"
"ec2:CreateTags"
],
"Resource": [
"arn:*:ec2:*:*:volume/*",
"arn:*:ec2:*:*:snapshot/*"
]
},
{
"Effect": "Allow",
"Action": [
"ec2:CreateVolume"
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:snapshot/*"
],
"Resource": "arn:*:ec2:*:*:volume/*",
"Condition": {
"StringLike": {
"aws:RequestTag/ebs.csi.aws.com/cluster": "true"
"StringEquals": {
"ec2:CreateAction": [
"CreateVolume",
"CreateSnapshot"
]
}
}
},
{
"Effect": "Allow",
"Action": [
"ec2:CreateVolume"
"ec2:CreateTags",
"ec2:DeleteTags"
],
"Resource": [
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:snapshot/*"
],
"Resource": "arn:*:ec2:*:*:volume/*",
"Condition": {
"StringLike": {
"aws:RequestTag/CSIVolumeName": "*"
"StringNotLike": {
"aws:RequestTag/ebs.csi.aws.com/cluster": "*",
"aws:RequestTag/CSIVolumeName": "*",
"aws:RequestTag/CSIVolumeSnapshotName": "*",
"aws:RequestTag/kubernetes.io/created-for/pvc/name": "*"
}
}
},
Expand All @@ -67,53 +65,45 @@
"Action": [
"ec2:CreateVolume"
],
"Resource": "arn:*:ec2:*:*:snapshot/*"
},
{
"Effect": "Allow",
"Action": [
"ec2:DeleteVolume"
],
"Resource": "*",
"Resource": "arn:aws:ec2:*:*:volume/*",
"Condition": {
"StringLike": {
"ec2:ResourceTag/ebs.csi.aws.com/cluster": "true"
"ForAnyValue:StringLike": {
"aws:RequestTag/ebs.csi.aws.com/cluster": "true",
"aws:RequestTag/CSIVolumeName": "*"
}
}
},
{
"Effect": "Allow",
"Action": [
"ec2:DeleteVolume"
"ec2:CreateVolume"
],
"Resource": "*",
"Condition": {
"StringLike": {
"ec2:ResourceTag/CSIVolumeName": "*"
}
}
"Resource": "arn:aws:ec2:*:*:snapshot/*"
},
{
"Effect": "Allow",
"Action": [
"ec2:DeleteVolume"
],
"Resource": "*",
"Resource": "arn:aws:ec2:*:*:volume/*",
"Condition": {
"StringLike": {
"ec2:ResourceTag/kubernetes.io/created-for/pvc/name": "*"
"ForAnyValue:StringLike": {
"aws:ResourceTag/ebs.csi.aws.com/cluster": "true",
"aws:ResourceTag/CSIVolumeName": "*",
"aws:ResourceTag/kubernetes.io/created-for/pvc/name": "*"
}
}
},
{
"Effect": "Allow",
"Action": [
"ec2:DeleteSnapshot"
"ec2:CreateSnapshot"
],
"Resource": "*",
"Resource": "arn:aws:ec2:*:*:snapshot/*",
"Condition": {
"StringLike": {
"ec2:ResourceTag/CSIVolumeSnapshotName": "*"
"ForAnyValue:StringLike": {
"aws:RequestTag/ebs.csi.aws.com/cluster": "true",
"aws:RequestTag/CSIVolumeSnapshotName": "*"
}
}
},
Expand All @@ -122,10 +112,11 @@
"Action": [
"ec2:DeleteSnapshot"
],
"Resource": "*",
"Resource": "arn:aws:ec2:*:*:snapshot/*",
"Condition": {
"StringLike": {
"ec2:ResourceTag/ebs.csi.aws.com/cluster": "true"
"ForAnyValue:StringLike": {
"aws:ResourceTag/ebs.csi.aws.com/cluster": "true",
"aws:ResourceTag/CSIVolumeSnapshotName": "*"
}
}
}
Expand Down
98 changes: 46 additions & 52 deletions hack/e2e/kops/patch-cluster.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -30,61 +30,62 @@ spec:
{
"Effect": "Allow",
"Action": [
"ec2:CreateSnapshot",
"ec2:AttachVolume",
"ec2:DetachVolume",
"ec2:ModifyVolume",
"ec2:DescribeAvailabilityZones",
"ec2:DescribeInstances",
"ec2:DescribeSnapshots",
"ec2:DescribeTags",
"ec2:DescribeVolumes",
"ec2:DescribeVolumesModifications",
"ec2:EnableFastSnapshotRestores"
"ec2:DescribeVolumesModifications"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"ec2:CreateTags"
"ec2:AttachVolume",
"ec2:DetachVolume",
"ec2:ModifyVolume",
"ec2:CreateSnapshot"
],
"Resource": [
"arn:*:ec2:*:*:volume/*",
"arn:*:ec2:*:*:snapshot/*"
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:instance/*"
]
},
{
"Effect": "Allow",
"Action": [
"ec2:DeleteTags"
"ec2:CreateTags"
],
"Resource": [
"arn:*:ec2:*:*:volume/*",
"arn:*:ec2:*:*:snapshot/*"
]
},
{
"Effect": "Allow",
"Action": [
"ec2:CreateVolume"
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:snapshot/*"
],
"Resource": "arn:*:ec2:*:*:volume/*",
"Condition": {
"StringLike": {
"aws:RequestTag/ebs.csi.aws.com/cluster": "true"
"StringEquals": {
"ec2:CreateAction": [
"CreateVolume",
"CreateSnapshot"
]
}
}
},
{
"Effect": "Allow",
"Action": [
"ec2:CreateVolume"
"ec2:CreateTags",
"ec2:DeleteTags"
],
"Resource": [
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:snapshot/*"
],
"Resource": "arn:*:ec2:*:*:volume/*",
"Condition": {
"StringLike": {
"aws:RequestTag/CSIVolumeName": "*"
"StringNotLike": {
"aws:RequestTag/ebs.csi.aws.com/cluster": "*",
"aws:RequestTag/CSIVolumeName": "*",
"aws:RequestTag/CSIVolumeSnapshotName": "*",
"aws:RequestTag/kubernetes.io/created-for/pvc/name": "*"
}
}
},
Expand All @@ -93,53 +94,45 @@ spec:
"Action": [
"ec2:CreateVolume"
],
"Resource": "arn:*:ec2:*:*:snapshot/*"
},
{
"Effect": "Allow",
"Action": [
"ec2:DeleteVolume"
],
"Resource": "*",
"Resource": "arn:aws:ec2:*:*:volume/*",
"Condition": {
"StringLike": {
"ec2:ResourceTag/ebs.csi.aws.com/cluster": "true"
"ForAnyValue:StringLike": {
"aws:RequestTag/ebs.csi.aws.com/cluster": "true",
"aws:RequestTag/CSIVolumeName": "*"
}
}
},
{
"Effect": "Allow",
"Action": [
"ec2:DeleteVolume"
"ec2:CreateVolume"
],
"Resource": "*",
"Condition": {
"StringLike": {
"ec2:ResourceTag/CSIVolumeName": "*"
}
}
"Resource": "arn:aws:ec2:*:*:snapshot/*"
},
{
"Effect": "Allow",
"Action": [
"ec2:DeleteVolume"
],
"Resource": "*",
"Resource": "arn:aws:ec2:*:*:volume/*",
"Condition": {
"StringLike": {
"ec2:ResourceTag/kubernetes.io/created-for/pvc/name": "*"
"ForAnyValue:StringLike": {
"aws:ResourceTag/ebs.csi.aws.com/cluster": "true",
"aws:ResourceTag/CSIVolumeName": "*",
"aws:ResourceTag/kubernetes.io/created-for/pvc/name": "*"
}
}
},
{
"Effect": "Allow",
"Action": [
"ec2:DeleteSnapshot"
"ec2:CreateSnapshot"
],
"Resource": "*",
"Resource": "arn:aws:ec2:*:*:snapshot/*",
"Condition": {
"StringLike": {
"ec2:ResourceTag/CSIVolumeSnapshotName": "*"
"ForAnyValue:StringLike": {
"aws:RequestTag/ebs.csi.aws.com/cluster": "true",
"aws:RequestTag/CSIVolumeSnapshotName": "*"
}
}
},
Expand All @@ -148,10 +141,11 @@ spec:
"Action": [
"ec2:DeleteSnapshot"
],
"Resource": "*",
"Resource": "arn:aws:ec2:*:*:snapshot/*",
"Condition": {
"StringLike": {
"ec2:ResourceTag/ebs.csi.aws.com/cluster": "true"
"ForAnyValue:StringLike": {
"aws:ResourceTag/ebs.csi.aws.com/cluster": "true",
"aws:ResourceTag/CSIVolumeSnapshotName": "*"
}
}
}
Expand Down

0 comments on commit 82d86cd

Please sign in to comment.