Skip to content

Commit

Permalink
[WIP] Update IAM policy
Browse files Browse the repository at this point in the history 
Signed-off-by: Connor Catlett <[email protected]>
  • Loading branch information
@ConnorJC3
ConnorJC3 committed Nov 15, 2024
1 parent de6e80e commit 9f612ec
Show file tree
Hide file tree
Showing 2 changed files with 202 additions and 40 deletions.
121 changes: 101 additions & 20 deletions docs/example-iam-policy.json
View file
Original file line number Diff line number Diff line change
Expand Up @@ -4,49 +4,101 @@
{
"Effect": "Allow",
"Action": [
"ec2:CreateSnapshot",
"ec2:AttachVolume",
"ec2:DetachVolume",
"ec2:ModifyVolume",
"ec2:DescribeAvailabilityZones",
"ec2:DescribeInstances",
"ec2:DescribeSnapshots",
"ec2:DescribeTags",
"ec2:DescribeVolumes",
"ec2:DescribeVolumesModifications",
"ec2:EnableFastSnapshotRestores"
"ec2:DescribeVolumesModifications"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"ec2:CreateTags"
"ec2:ModifyVolume"
],
"Resource": "arn:aws:ec2:*:*:volume/*"
},
{
"Effect": "Allow",
"Action": [
"ec2:AttachVolume",
"ec2:DetachVolume"
],
"Resource": [
"arn:*:ec2:*:*:volume/*",
"arn:*:ec2:*:*:snapshot/*"
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:instance/*"
]
},
{
"Effect": "Allow",
"Action": [
"ec2:DeleteTags"
"ec2:CreateVolume",
"ec2:EnableFastSnapshotRestores"
],
"Resource": "arn:aws:ec2:*:*:snapshot/*"
},
{
"Effect": "Allow",
"Action": [
"ec2:CreateVolume",
"ec2:EnableFastSnapshotRestores"
],
"Resource": "arn:aws:ec2:*:*:snapshot/*"
},
{
"Effect": "Allow",
"Action": [
"ec2:CreateTags"
],
"Resource": [
"arn:*:ec2:*:*:volume/*",
"arn:*:ec2:*:*:snapshot/*"
]
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:snapshot/*"
],
"Condition": {
"StringEquals": {
"ec2:CreateAction": [
"CreateVolume",
"CreateSnapshot"
]
}
}
},
{
"Effect": "Allow",
"Action": [
"ec2:CreateVolume"
"ec2:CreateTags"
],
"Resource": [
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:snapshot/*"
],
"Resource": "arn:*:ec2:*:*:volume/*",
"Condition": {
"StringLike": {
"aws:RequestTag/ebs.csi.aws.com/cluster": "true"
"StringEquals": {
"ec2:CreateAction": [
"CreateVolume",
"CreateSnapshot"
]
}
}
},
{
"Effect": "Allow",
"Action": [
"ec2:CreateTags",
"ec2:DeleteTags"
],
"Resource": [
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:snapshot/*"
],
"Condition": {
"StringNotLike": {
"aws:RequestTag/ebs.csi.aws.com/cluster": "*",
"aws:RequestTag/CSIVolumeName": "*",
"aws:RequestTag/CSIVolumeSnapshotName": "*",
"aws:RequestTag/kubernetes.io/created-for/pvc/name": "*"
}
}
},
Expand All @@ -55,10 +107,10 @@
"Action": [
"ec2:CreateVolume"
],
"Resource": "arn:*:ec2:*:*:volume/*",
"Resource": "*",
"Condition": {
"StringLike": {
"aws:RequestTag/CSIVolumeName": "*"
"aws:RequestTag/ebs.csi.aws.com/cluster": "true"
}
}
},
Expand All @@ -67,7 +119,12 @@
"Action": [
"ec2:CreateVolume"
],
"Resource": "arn:*:ec2:*:*:snapshot/*"
"Resource": "*",
"Condition": {
"StringLike": {
"aws:RequestTag/CSIVolumeName": "*"
}
}
},
{
"Effect": "Allow",
Expand Down Expand Up @@ -105,6 +162,30 @@
}
}
},
{
"Effect": "Allow",
"Action": [
"ec2:CreateSnapshot"
],
"Resource": "*",
"Condition": {
"StringLike": {
"aws:RequestTag/ebs.csi.aws.com/cluster": "true"
}
}
},
{
"Effect": "Allow",
"Action": [
"ec2:CreateSnapshot"
],
"Resource": "*",
"Condition": {
"StringLike": {
"aws:RequestTag/CSIVolumeSnapshotName": "*"
}
}
},
{
"Effect": "Allow",
"Action": [
Expand Down
121 changes: 101 additions & 20 deletions hack/e2e/kops/patch-cluster.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -30,49 +30,101 @@ spec:
{
"Effect": "Allow",
"Action": [
"ec2:CreateSnapshot",
"ec2:AttachVolume",
"ec2:DetachVolume",
"ec2:ModifyVolume",
"ec2:DescribeAvailabilityZones",
"ec2:DescribeInstances",
"ec2:DescribeSnapshots",
"ec2:DescribeTags",
"ec2:DescribeVolumes",
"ec2:DescribeVolumesModifications",
"ec2:EnableFastSnapshotRestores"
"ec2:DescribeVolumesModifications"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"ec2:CreateTags"
"ec2:ModifyVolume"
],
"Resource": "arn:aws:ec2:*:*:volume/*"
},
{
"Effect": "Allow",
"Action": [
"ec2:AttachVolume",
"ec2:DetachVolume"
],
"Resource": [
"arn:*:ec2:*:*:volume/*",
"arn:*:ec2:*:*:snapshot/*"
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:instance/*"
]
},
{
"Effect": "Allow",
"Action": [
"ec2:DeleteTags"
"ec2:CreateVolume",
"ec2:EnableFastSnapshotRestores"
],
"Resource": "arn:aws:ec2:*:*:snapshot/*"
},
{
"Effect": "Allow",
"Action": [
"ec2:CreateVolume",
"ec2:EnableFastSnapshotRestores"
],
"Resource": "arn:aws:ec2:*:*:snapshot/*"
},
{
"Effect": "Allow",
"Action": [
"ec2:CreateTags"
],
"Resource": [
"arn:*:ec2:*:*:volume/*",
"arn:*:ec2:*:*:snapshot/*"
]
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:snapshot/*"
],
"Condition": {
"StringEquals": {
"ec2:CreateAction": [
"CreateVolume",
"CreateSnapshot"
]
}
}
},
{
"Effect": "Allow",
"Action": [
"ec2:CreateVolume"
"ec2:CreateTags"
],
"Resource": [
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:snapshot/*"
],
"Resource": "arn:*:ec2:*:*:volume/*",
"Condition": {
"StringLike": {
"aws:RequestTag/ebs.csi.aws.com/cluster": "true"
"StringEquals": {
"ec2:CreateAction": [
"CreateVolume",
"CreateSnapshot"
]
}
}
},
{
"Effect": "Allow",
"Action": [
"ec2:CreateTags",
"ec2:DeleteTags"
],
"Resource": [
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:snapshot/*"
],
"Condition": {
"StringNotLike": {
"aws:RequestTag/ebs.csi.aws.com/cluster": "*",
"aws:RequestTag/CSIVolumeName": "*",
"aws:RequestTag/CSIVolumeSnapshotName": "*",
"aws:RequestTag/kubernetes.io/created-for/pvc/name": "*"
}
}
},
Expand All @@ -81,10 +133,10 @@ spec:
"Action": [
"ec2:CreateVolume"
],
"Resource": "arn:*:ec2:*:*:volume/*",
"Resource": "*",
"Condition": {
"StringLike": {
"aws:RequestTag/CSIVolumeName": "*"
"aws:RequestTag/ebs.csi.aws.com/cluster": "true"
}
}
},
Expand All @@ -93,7 +145,12 @@ spec:
"Action": [
"ec2:CreateVolume"
],
"Resource": "arn:*:ec2:*:*:snapshot/*"
"Resource": "*",
"Condition": {
"StringLike": {
"aws:RequestTag/CSIVolumeName": "*"
}
}
},
{
"Effect": "Allow",
Expand Down Expand Up @@ -131,6 +188,30 @@ spec:
}
}
},
{
"Effect": "Allow",
"Action": [
"ec2:CreateSnapshot"
],
"Resource": "*",
"Condition": {
"StringLike": {
"aws:RequestTag/ebs.csi.aws.com/cluster": "true"
}
}
},
{
"Effect": "Allow",
"Action": [
"ec2:CreateSnapshot"
],
"Resource": "*",
"Condition": {
"StringLike": {
"aws:RequestTag/CSIVolumeSnapshotName": "*"
}
}
},
{
"Effect": "Allow",
"Action": [
Expand Down

0 comments on commit 9f612ec

Please sign in to comment.