Skip to content

PCP-5892 - Minimum Permissions Revamp for AWS #9514

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
benradstone wants to merge 16 commits into
base: docs-rel-4-8-b
Choose a base branch
from
Open

PCP-5892 - Minimum Permissions Revamp for AWS #9514

Show file tree
Hide file tree
Changes from 13 commits
Commits
Show all changes
16 commits
Select commit Hold shift + click to select a range
a0ecf2a
docs: AWS Minimum Permissions Refresh with CF steps
benradstone Feb 6, 2026
abe900a
docs: Manual CF Stack Management guidance
benradstone Feb 6, 2026
05d17f9
docs: Release note and IAM role naming convention guidance
benradstone Feb 9, 2026
a280fb9
ci: auto-formatting prettier issues
benradstone Feb 9, 2026
1449ced
docs: minor improvements
benradstone Feb 9, 2026
1aa7a0b
Merge branch 'PCP-5892' of github.com:spectrocloud/librarium into PCP…
benradstone Feb 9, 2026
9281443
Merge branch 'docs-rel-4-8-b' into PCP-5892
benradstone Feb 9, 2026
ee97cab
docs: Apply suggestions from code review
benradstone Feb 10, 2026
826d377
ci: auto-formatting prettier issues
benradstone Feb 10, 2026
beacd46
docs: final peer comments resolved
benradstone Feb 10, 2026
ee5dc26
docs: fix admonition break
benradstone Feb 10, 2026
2d120bf
Merge branch 'docs-rel-4-8-b' into PCP-5892
benradstone Feb 10, 2026
76095b1
docs: clarify Global Role Additional Policies use-case
benradstone Feb 10, 2026
aeaa12d
docs: Apply suggestion from peer review
benradstone Feb 10, 2026
ea5de56
docs: fix indentation of aws-ebs-csi-driver-policy
benradstone Feb 10, 2026
ed1d833
Merge branch 'PCP-5892' of github.com:spectrocloud/librarium into PCP…
benradstone Feb 10, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
149 changes: 0 additions & 149 deletions _partials/permissions/_aws-dynamic-permissions.mdx
View file
Open in desktop

This file was deleted.

110 changes: 110 additions & 0 deletions _partials/permissions/_aws-eks-dynamic-permissions.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,110 @@
---
partial_category: permissions
partial_name: aws-eks-dynamic-permissions
---
**Last Update**: February 14, 2026

```json
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "ASGDescribe",
"Effect": "Allow",
"Action": "autoscaling:DescribeAutoScalingGroups",
"Resource": "*"
},
{
"Sid": "EC2Permissions",
"Effect": "Allow",
"Action": [
"ec2:AuthorizeSecurityGroupIngress",
"ec2:DeleteSubnet",
"ec2:DescribeAddresses",
"ec2:DescribeInstances",
"ec2:CreateNatGateway",
"ec2:DescribeRegions",
"ec2:CreateVpc",
"ec2:AttachInternetGateway",
"ec2:DescribeVpcAttribute",
"ec2:DeleteRouteTable",
"ec2:ModifySubnetAttribute",
"ec2:AssociateRouteTable",
"ec2:DescribeInternetGateways",
"ec2:DescribeNetworkInterfaces",
"ec2:DescribeAvailabilityZones",
"ec2:CreateRoute",
"ec2:CreateInternetGateway",
"ec2:CreateSecurityGroup",
"ec2:ModifyVpcAttribute",
"ec2:DeleteInternetGateway",
"ec2:DescribeKeyPairs",
"ec2:DescribeRouteTables",
"ec2:ReleaseAddress",
"ec2:CreateTags",
"ec2:DeleteNetworkInterface",
"ec2:CreateRouteTable",
"ec2:DetachInternetGateway",
"ec2:DescribeNatGateways",
"ec2:DisassociateRouteTable",
"ec2:AllocateAddress",
"ec2:DescribeSecurityGroups",
"ec2:DescribeVpcs",
"ec2:DeleteSecurityGroup",
"ec2:DeleteNatGateway",
"ec2:DescribeVpcEndpoints",
"ec2:DeleteVpc",
"ec2:CreateSubnet",
"ec2:DescribeSubnets"
],
"Resource": "*"
},
{
"Sid": "EKSPermissions",
"Effect": "Allow",
"Action": [
"eks:DeleteCluster",
"eks:DescribeNodegroup",
"eks:DeleteNodegroup",
"eks:TagResource",
"eks:ListAddons",
"eks:DescribeCluster",
"eks:CreateNodegroup",
"eks:CreateCluster"
],
"Resource": "*"
},
{
"Sid": "IAMListOpenIDConnectProviders",
"Effect": "Allow",
"Action": "iam:ListOpenIDConnectProviders",
"Resource": "*"
},
{
"Sid": "IAMOpenIDConnectProviderPermissions",
"Effect": "Allow",
"Action": [
"iam:DeleteOpenIDConnectProvider",
"iam:GetOpenIDConnectProvider",
"iam:TagOpenIDConnectProvider",
"iam:CreateOpenIDConnectProvider"
],
"Resource": [
"arn:aws:iam::*:oidc-provider/*"
]
},
{
"Sid": "IAMRolePermissions",
"Effect": "Allow",
"Action": [
"iam:GetRole",
"iam:PassRole",
"iam:ListAttachedRolePolicies"
],
"Resource": [
"arn:*:iam::*:role/*.cluster-api-provider-aws.sigs.k8s.io"
]
}
]
}
```
89 changes: 89 additions & 0 deletions _partials/permissions/_aws-eks-static-permissions.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,89 @@
---
partial_category: permissions
partial_name: aws-eks-static-permissions
---
**Last Update**: February 14, 2026

```json
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "ASGDescribe",
"Effect": "Allow",
"Action": "autoscaling:DescribeAutoScalingGroups",
"Resource": "*"
},
{
"Sid": "EC2Permissions",
"Effect": "Allow",
"Action": [
"ec2:AuthorizeSecurityGroupIngress",
"ec2:DescribeAddresses",
"ec2:DescribeInstances",
"ec2:DeleteTags",
"ec2:DescribeTags",
"ec2:CreateTags",
"ec2:DescribeRegions",
"ec2:DescribeNatGateways",
"ec2:DescribeSecurityGroups",
"ec2:DescribeNetworkInterfaces",
"ec2:DescribeAvailabilityZones",
"ec2:DescribeVpcs",
"ec2:CreateSecurityGroup",
"ec2:DeleteSecurityGroup",
"ec2:DescribeSubnets",
"ec2:DescribeKeyPairs",
"ec2:DescribeRouteTables"
],
"Resource": "*"
},
{
"Sid": "EKSPermissions",
"Effect": "Allow",
"Action": [
"eks:DeleteCluster",
"eks:DescribeNodegroup",
"eks:DeleteNodegroup",
"eks:TagResource",
"eks:ListAddons",
"eks:DescribeCluster",
"eks:CreateNodegroup",
"eks:CreateCluster"
],
"Resource": "*"
},
{
"Sid": "IAMListOpenIDConnectProviders",
"Effect": "Allow",
"Action": "iam:ListOpenIDConnectProviders",
"Resource": "*"
},
{
"Sid": "IAMOpenIDConnectProviderPermissions",
"Effect": "Allow",
"Action": [
"iam:DeleteOpenIDConnectProvider",
"iam:GetOpenIDConnectProvider",
"iam:TagOpenIDConnectProvider",
"iam:CreateOpenIDConnectProvider"
],
"Resource": [
"arn:aws:iam::*:oidc-provider/*"
]
},
{
"Sid": "IAMRolePermissions",
"Effect": "Allow",
"Action": [
"iam:GetRole",
"iam:PassRole",
"iam:ListAttachedRolePolicies"
],
"Resource": [
"arn:*:iam::*:role/*.cluster-api-provider-aws.sigs.k8s.io"
]
}
]
}
```
Loading