Skip to content

Commit fc23e74

Browse files
mdzrafmdzraf
committed
[DO NOT MERGE] Testing Minimal Policy
1 parent 33be568 commit fc23e74

File tree

3 files changed

+225
-194
lines changed

3 files changed

+225
-194
lines changed

‎docs/example-iam-policy.json‎

Lines changed: 99 additions & 113 deletions
Original file line numberDiff line numberDiff line change
@@ -1,67 +1,89 @@
11
{
2-
"Version": "2012-10-17",
3-
"Statement": [
2+
"Version" : "2012-10-17",
3+
"Statement" : [
44
{
5-
"Effect": "Allow",
6-
"Action": [
5+
"Effect" : "Allow",
6+
"Action" : [
77
"ec2:DescribeAvailabilityZones",
88
"ec2:DescribeInstances",
99
"ec2:DescribeSnapshots",
10-
"ec2:DescribeTags",
1110
"ec2:DescribeVolumes",
1211
"ec2:DescribeVolumesModifications",
1312
"ec2:DescribeVolumeStatus"
1413
],
15-
"Resource": "*"
14+
"Resource" : "*"
1615
},
1716
{
18-
"Effect": "Allow",
19-
"Action": [
17+
"Effect" : "Allow",
18+
"Action" : [
2019
"ec2:CreateSnapshot",
2120
"ec2:ModifyVolume"
2221
],
23-
"Resource": "arn:aws:ec2:*:*:volume/*"
22+
"Resource" : "arn:aws:ec2:*:*:volume/*",
23+
"Condition" : {
24+
"StringLike" : {
25+
"ec2:ResourceTag/ebs.csi.aws.com/cluster" : "true"
26+
}
27+
}
2428
},
2529
{
26-
"Effect": "Allow",
27-
"Action": [
30+
"Effect" : "Allow",
31+
"Action" : [
2832
"ec2:CopyVolumes"
2933
],
30-
"Resource": [
31-
"arn:aws:ec2:*:*:volume/vol-*"
32-
]
34+
"Resource" : "arn:aws:ec2:*:*:volume/vol-*",
35+
"Condition" : {
36+
"StringLike" : {
37+
"ec2:ResourceTag/ebs.csi.aws.com/cluster" : "true"
38+
}
39+
}
3340
},
3441
{
35-
"Effect": "Allow",
36-
"Action": [
42+
"Effect" : "Allow",
43+
"Action" : [
3744
"ec2:AttachVolume",
3845
"ec2:DetachVolume"
3946
],
40-
"Resource": [
41-
"arn:aws:ec2:*:*:volume/*",
42-
"arn:aws:ec2:*:*:instance/*"
43-
]
47+
"Resource" : "arn:aws:ec2:*:*:volume/*",
48+
"Condition" : {
49+
"StringLike" : {
50+
"ec2:ResourceTag/ebs.csi.aws.com/cluster" : "true"
51+
}
52+
}
4453
},
4554
{
46-
"Effect": "Allow",
47-
"Action": [
55+
"Effect" : "Allow",
56+
"Action" : [
57+
"ec2:AttachVolume",
58+
"ec2:DetachVolume"
59+
],
60+
"Resource" : "arn:aws:ec2:*:*:instance/*"
61+
},
62+
{
63+
"Effect" : "Allow",
64+
"Action" : [
4865
"ec2:CreateVolume",
4966
"ec2:EnableFastSnapshotRestores"
5067
],
51-
"Resource": "arn:aws:ec2:*:*:snapshot/*"
68+
"Resource" : "arn:aws:ec2:*:*:snapshot/*",
69+
"Condition" : {
70+
"StringLike" : {
71+
"ec2:ResourceTag/ebs.csi.aws.com/cluster" : "true"
72+
}
73+
}
5274
},
5375
{
54-
"Effect": "Allow",
55-
"Action": [
76+
"Effect" : "Allow",
77+
"Action" : [
5678
"ec2:CreateTags"
5779
],
58-
"Resource": [
80+
"Resource" : [
5981
"arn:aws:ec2:*:*:volume/*",
6082
"arn:aws:ec2:*:*:snapshot/*"
6183
],
62-
"Condition": {
63-
"StringEquals": {
64-
"ec2:CreateAction": [
84+
"Condition" : {
85+
"StringEquals" : {
86+
"ec2:CreateAction" : [
6587
"CreateVolume",
6688
"CreateSnapshot",
6789
"CopyVolumes"
@@ -70,122 +92,86 @@
7092
}
7193
},
7294
{
73-
"Effect": "Allow",
74-
"Action": [
95+
"Effect" : "Allow",
96+
"Action" : [
7597
"ec2:DeleteTags"
7698
],
77-
"Resource": [
99+
"Resource" : [
78100
"arn:aws:ec2:*:*:volume/*",
79101
"arn:aws:ec2:*:*:snapshot/*"
80-
]
81-
},
82-
{
83-
"Effect": "Allow",
84-
"Action": [
85-
"ec2:CreateVolume",
86-
"ec2:CopyVolumes"
87102
],
88-
"Resource": "arn:aws:ec2:*:*:volume/*",
89-
"Condition": {
90-
"StringLike": {
91-
"aws:RequestTag/ebs.csi.aws.com/cluster": "true"
103+
"Condition" : {
104+
"StringLike" : {
105+
"ec2:ResourceTag/ebs.csi.aws.com/cluster" : "true"
92106
}
93107
}
94108
},
95109
{
96-
"Effect": "Allow",
97-
"Action": [
98-
"ec2:CreateVolume",
99-
"ec2:CopyVolumes"
100-
],
101-
"Resource": "arn:aws:ec2:*:*:volume/*",
102-
"Condition": {
103-
"StringLike": {
104-
"aws:RequestTag/CSIVolumeName": "*"
105-
}
106-
}
107-
},
108-
{
109-
"Effect": "Allow",
110-
"Action": [
111-
"ec2:DeleteVolume"
110+
"Effect" : "Allow",
111+
"Action" : [
112+
"ec2:CreateTags"
112113
],
113-
"Resource": "arn:aws:ec2:*:*:volume/*",
114-
"Condition": {
115-
"StringLike": {
116-
"ec2:ResourceTag/ebs.csi.aws.com/cluster": "true"
114+
"Resource" : "arn:aws:ec2:*:*:volume/*",
115+
"Condition" : {
116+
"ForAnyValue:StringLike" : {
117+
"ec2:ResourceTag/ebs.csi.aws.com/cluster" : "true",
118+
"ec2:ResourceTag/CSIVolumeName" : "*",
119+
"ec2:ResourceTag/kubernetes.io/created-for/pvc/name" : "*"
117120
}
118121
}
119122
},
120123
{
121-
"Effect": "Allow",
122-
"Action": [
123-
"ec2:DeleteVolume"
124+
"Effect" : "Allow",
125+
"Action" : [
126+
"ec2:CreateVolume",
127+
"ec2:CopyVolumes"
124128
],
125-
"Resource": "arn:aws:ec2:*:*:volume/*",
126-
"Condition": {
127-
"StringLike": {
128-
"ec2:ResourceTag/CSIVolumeName": "*"
129+
"Resource" : "arn:aws:ec2:*:*:volume/*",
130+
"Condition" : {
131+
"ForAnyValue:StringLike" : {
132+
"aws:RequestTag/ebs.csi.aws.com/cluster" : "true",
133+
"aws:RequestTag/CSIVolumeName" : "*"
129134
}
130135
}
131136
},
132137
{
133-
"Effect": "Allow",
134-
"Action": [
138+
"Effect" : "Allow",
139+
"Action" : [
135140
"ec2:DeleteVolume"
136141
],
137-
"Resource": "arn:aws:ec2:*:*:volume/*",
138-
"Condition": {
139-
"StringLike": {
140-
"ec2:ResourceTag/kubernetes.io/created-for/pvc/name": "*"
141-
}
142-
}
143-
},
144-
{
145-
"Effect": "Allow",
146-
"Action": [
147-
"ec2:CreateSnapshot"
148-
],
149-
"Resource": "arn:aws:ec2:*:*:snapshot/*",
150-
"Condition": {
151-
"StringLike": {
152-
"aws:RequestTag/CSIVolumeSnapshotName": "*"
142+
"Resource" : "arn:aws:ec2:*:*:volume/*",
143+
"Condition" : {
144+
"ForAnyValue:StringLike" : {
145+
"ec2:ResourceTag/ebs.csi.aws.com/cluster" : "true",
146+
"ec2:ResourceTag/CSIVolumeName" : "*",
147+
"ec2:ResourceTag/kubernetes.io/created-for/pvc/name" : "*"
153148
}
154149
}
155150
},
156151
{
157-
"Effect": "Allow",
158-
"Action": [
152+
"Effect" : "Allow",
153+
"Action" : [
159154
"ec2:CreateSnapshot"
160155
],
161-
"Resource": "arn:aws:ec2:*:*:snapshot/*",
162-
"Condition": {
163-
"StringLike": {
164-
"aws:RequestTag/ebs.csi.aws.com/cluster": "true"
165-
}
166-
}
167-
},
168-
{
169-
"Effect": "Allow",
170-
"Action": [
171-
"ec2:DeleteSnapshot"
172-
],
173-
"Resource": "arn:aws:ec2:*:*:snapshot/*",
174-
"Condition": {
175-
"StringLike": {
176-
"ec2:ResourceTag/CSIVolumeSnapshotName": "*"
156+
"Resource" : "arn:aws:ec2:*:*:snapshot/*",
157+
"Condition" : {
158+
"ForAnyValue:StringLike" : {
159+
"aws:RequestTag/CSIVolumeSnapshotName" : "*",
160+
"aws:RequestTag/ebs.csi.aws.com/cluster" : "true"
177161
}
178162
}
179163
},
180164
{
181-
"Effect": "Allow",
182-
"Action": [
183-
"ec2:DeleteSnapshot"
165+
"Effect" : "Allow",
166+
"Action" : [
167+
"ec2:DeleteSnapshot",
168+
"ec2:LockSnapshot"
184169
],
185-
"Resource": "arn:aws:ec2:*:*:snapshot/*",
186-
"Condition": {
187-
"StringLike": {
188-
"ec2:ResourceTag/ebs.csi.aws.com/cluster": "true"
170+
"Resource" : "arn:aws:ec2:*:*:snapshot/*",
171+
"Condition" : {
172+
"ForAnyValue:StringLike" : {
173+
"ec2:ResourceTag/CSIVolumeSnapshotName" : "*",
174+
"ec2:ResourceTag/ebs.csi.aws.com/cluster" : "true"
189175
}
190176
}
191177
}

0 commit comments

Comments
 (0)