Skip to content

Commit f6abce7

Browse files
Superm4n97Superm4n97
authored
Add AWS IAM policy file for selfhost permission (#484)
Signed-off-by: rasel <rasel@appscode.com>
1 parent f21e347 commit f6abce7

File tree

2 files changed

+361
-0
lines changed

2 files changed

+361
-0
lines changed

‎files/products/appscode/aws-selfhost/iam-ec2-permissions.json‎

Lines changed: 206 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,206 @@
1+
{
2+
"Version": "2012-10-17",
3+
"Statement": [
4+
5+
{
6+
"Action": [
7+
"iam:ListOpenIDConnectProviders",
8+
"iam:ListPolicies"
9+
],
10+
"Resource": "*",
11+
"Effect": "Allow"
12+
},
13+
{
14+
"Action": [
15+
"iam:UpdateRole"
16+
],
17+
"Resource": "arn:*:iam::*:role/Ace*",
18+
"Effect": "Allow"
19+
},
20+
{
21+
"Action": [
22+
"ec2:TerminateInstances"
23+
],
24+
"Resource": "arn:*:ec2:*:*:instance/i-*",
25+
"Effect": "Allow"
26+
},
27+
{
28+
"Action": [
29+
"autoscaling:CreateAutoScalingGroup",
30+
"autoscaling:UpdateAutoScalingGroup",
31+
"autoscaling:CreateOrUpdateTags",
32+
"autoscaling:StartInstanceRefresh",
33+
"autoscaling:DeleteAutoScalingGroup",
34+
"autoscaling:DeleteTags"
35+
],
36+
"Resource": "arn:*:autoscaling:*:*:autoScalingGroup:*:autoScalingGroupName/*",
37+
"Effect": "Allow"
38+
},
39+
{
40+
"Condition": {
41+
"StringLike": {
42+
"iam:AWSServiceName": "elasticloadbalancing.amazonaws.com"
43+
}
44+
},
45+
"Action": [
46+
"iam:CreateServiceLinkedRole"
47+
],
48+
"Resource": [
49+
"arn:*:iam::*:role/aws-service-role/autoscaling.amazonaws.com/AWSServiceRoleForAutoScaling"
50+
],
51+
"Effect": "Allow"
52+
},
53+
{
54+
"Condition": {
55+
"StringLike": {
56+
"iam:AWSServiceName": "elasticloadbalancing.amazonaws.com"
57+
}
58+
},
59+
"Action": [
60+
"iam:CreateServiceLinkedRole"
61+
],
62+
"Resource": [
63+
"arn:*:iam::*:role/aws-service-role/elasticloadbalancing.amazonaws.com/AWSServiceRoleForElasticLoadBalancing"
64+
],
65+
"Effect": "Allow"
66+
},
67+
{
68+
"Condition": {
69+
"StringLike": {
70+
"iam:AWSServiceName": "spot.amazonaws.com"
71+
}
72+
},
73+
"Action": [
74+
"iam:CreateServiceLinkedRole"
75+
],
76+
"Resource": [
77+
"arn:*:iam::*:role/aws-service-role/spot.amazonaws.com/AWSServiceRoleForEC2Spot"
78+
],
79+
"Effect": "Allow"
80+
},
81+
{
82+
"Action": [
83+
"iam:PassRole"
84+
],
85+
"Resource": [
86+
"arn:*:iam::*:role/*.cluster-api-provider-aws.sigs.k8s.io",
87+
"arn:*:iam::*:role/Ace*",
88+
"arn:*:iam::*:role/controllers*",
89+
"arn:*:iam::*:role/nodes*",
90+
"arn:*:iam::*:role/control-plane*",
91+
"arn:*:iam::*:role/controlplane*"
92+
],
93+
"Effect": "Allow"
94+
},
95+
{
96+
"Action": [
97+
"secretsmanager:CreateSecret",
98+
"secretsmanager:DeleteSecret",
99+
"secretsmanager:TagResource"
100+
],
101+
"Resource": [
102+
"arn:*:secretsmanager:*:*:secret:aws.cluster.x-k8s.io/*"
103+
],
104+
"Effect": "Allow"
105+
},
106+
{
107+
"Action": [
108+
"s3:CreateBucket",
109+
"s3:ListBucket",
110+
"s3:PutBucketCORS",
111+
"s3:DeleteBucket",
112+
"s3:GetBucketLocation",
113+
"s3:PutBucketOwnershipControls"
114+
],
115+
"Resource": [
116+
"arn:*:s3:::ace*"
117+
],
118+
"Effect": "Allow"
119+
},
120+
{
121+
"Action": [
122+
"s3:PutObject",
123+
"s3:GetObject",
124+
"s3:DeleteObject"
125+
],
126+
"Resource": [
127+
"arn:*:s3:::ace*"
128+
],
129+
"Effect": "Allow"
130+
},
131+
{
132+
"Action": [
133+
"cloudformation:*"
134+
],
135+
"Resource": [
136+
"arn:*:cloudformation:*:*:stack/*"
137+
],
138+
"Effect": "Allow"
139+
},
140+
{
141+
"Action": [
142+
"iam:CreateInstanceProfile",
143+
"iam:DeleteInstanceProfile",
144+
"iam:GetInstanceProfile",
145+
"iam:RemoveRoleFromInstanceProfile",
146+
"iam:AddRoleToInstanceProfile"
147+
],
148+
"Resource": [
149+
"arn:*:iam::*:instance-profile/controllers*",
150+
"arn:*:iam::*:instance-profile/nodes*",
151+
"arn:*:iam::*:instance-profile/control-plane*",
152+
"arn:*:iam::*:instance-profile/controlplane*"
153+
],
154+
"Effect": "Allow"
155+
},
156+
{
157+
"Action": [
158+
"iam:GetRole",
159+
"iam:ListAttachedRolePolicies"
160+
],
161+
"Resource": [
162+
"arn:*:iam::*:role/*"
163+
],
164+
"Effect": "Allow"
165+
},
166+
{
167+
"Action": [
168+
"iam:CreateRole",
169+
"iam:DeleteRole",
170+
"iam:AttachRolePolicy",
171+
"iam:PutRolePolicy",
172+
"iam:UpdateAssumeRolePolicy",
173+
"iam:ListInstanceProfilesForRole",
174+
"iam:DetachRolePolicy",
175+
"iam:DeleteRolePolicy",
176+
"iam:GetRolePolicy",
177+
"iam:TagRole",
178+
"iam:UntagRole"
179+
],
180+
"Resource": [
181+
"arn:*:iam::*:role/Ace*",
182+
"arn:*:iam::*:role/controllers*",
183+
"arn:*:iam::*:role/nodes*",
184+
"arn:*:iam::*:role/control-plane*",
185+
"arn:*:iam::*:role/controlplane*"
186+
],
187+
"Effect": "Allow"
188+
},
189+
{
190+
"Action": [
191+
"iam:GetPolicy",
192+
"iam:CreatePolicy",
193+
"iam:DeletePolicy",
194+
"iam:ListPolicyVersions"
195+
],
196+
"Resource": [
197+
"arn:*:iam::*:policy/Ace*",
198+
"arn:*:iam::*:policy/controllers*",
199+
"arn:*:iam::*:policy/nodes*",
200+
"arn:*:iam::*:policy/control-plane*",
201+
"arn:*:iam::*:policy/csi*"
202+
],
203+
"Effect": "Allow"
204+
}
205+
]
206+
}

‎files/products/appscode/aws-selfhost/iam-eks-permissions.json‎

Lines changed: 155 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,155 @@
1+
{
2+
"Version": "2012-10-17",
3+
"Statement": [
4+
{
5+
"Action": [
6+
"ec2:DescribeIpamPools",
7+
"ec2:AllocateIpamPoolCidr",
8+
"ec2:AttachNetworkInterface",
9+
"ec2:DetachNetworkInterface",
10+
"ec2:AllocateAddress",
11+
"ec2:AssignIpv6Addresses",
12+
"ec2:AssignPrivateIpAddresses",
13+
"ec2:UnassignPrivateIpAddresses",
14+
"ec2:AssociateRouteTable",
15+
"ec2:AssociateVpcCidrBlock",
16+
"ec2:AttachInternetGateway",
17+
"ec2:AuthorizeSecurityGroupIngress",
18+
"ec2:CreateCarrierGateway",
19+
"ec2:CreateInternetGateway",
20+
"ec2:CreateEgressOnlyInternetGateway",
21+
"ec2:CreateNatGateway",
22+
"ec2:CreateNetworkInterface",
23+
"ec2:CreateRoute",
24+
"ec2:CreateRouteTable",
25+
"ec2:CreateSecurityGroup",
26+
"ec2:CreateSubnet",
27+
"ec2:CreateTags",
28+
"ec2:CreateVpc",
29+
"ec2:CreateVpcEndpoint",
30+
"ec2:DisassociateVpcCidrBlock",
31+
"ec2:ModifyVpcAttribute",
32+
"ec2:ModifyVpcEndpoint",
33+
"ec2:DeleteCarrierGateway",
34+
"ec2:DeleteInternetGateway",
35+
"ec2:DeleteEgressOnlyInternetGateway",
36+
"ec2:DeleteNatGateway",
37+
"ec2:DeleteRouteTable",
38+
"ec2:ReplaceRoute",
39+
"ec2:DeleteSecurityGroup",
40+
"ec2:DeleteSubnet",
41+
"ec2:DeleteTags",
42+
"ec2:DeleteVpc",
43+
"ec2:DeleteVpcEndpoints",
44+
"ec2:DescribeAccountAttributes",
45+
"ec2:DescribeAddresses",
46+
"ec2:DescribeAvailabilityZones",
47+
"ec2:DescribeCarrierGateways",
48+
"ec2:DescribeInstances",
49+
"ec2:DescribeInstanceTypes",
50+
"ec2:DescribeInternetGateways",
51+
"ec2:DescribeEgressOnlyInternetGateways",
52+
"ec2:DescribeInstanceTypes",
53+
"ec2:DescribeImages",
54+
"ec2:DescribeNatGateways",
55+
"ec2:DescribeNetworkInterfaces",
56+
"ec2:DescribeNetworkInterfaceAttribute",
57+
"ec2:DescribeRouteTables",
58+
"ec2:DescribeSecurityGroups",
59+
"ec2:DescribeSubnets",
60+
"ec2:DescribeVpcs",
61+
"ec2:DescribeDhcpOptions",
62+
"ec2:DescribeVpcAttribute",
63+
"ec2:DescribeVpcEndpoints",
64+
"ec2:DescribeVolumes",
65+
"ec2:DescribeTags",
66+
"ec2:DetachInternetGateway",
67+
"ec2:DisassociateRouteTable",
68+
"ec2:DisassociateAddress",
69+
"ec2:ModifyInstanceAttribute",
70+
"ec2:ModifyNetworkInterfaceAttribute",
71+
"ec2:ModifySubnetAttribute",
72+
"ec2:ReleaseAddress",
73+
"ec2:RevokeSecurityGroupIngress",
74+
"ec2:RunInstances",
75+
"tag:GetResources",
76+
"elasticloadbalancing:AddTags",
77+
"elasticloadbalancing:CreateLoadBalancer",
78+
"elasticloadbalancing:ConfigureHealthCheck",
79+
"elasticloadbalancing:DeleteLoadBalancer",
80+
"elasticloadbalancing:DeleteTargetGroup",
81+
"elasticloadbalancing:DescribeLoadBalancers",
82+
"elasticloadbalancing:DescribeLoadBalancerAttributes",
83+
"elasticloadbalancing:DescribeTargetGroups",
84+
"elasticloadbalancing:ApplySecurityGroupsToLoadBalancer",
85+
"elasticloadbalancing:SetSecurityGroups",
86+
"elasticloadbalancing:DescribeTags",
87+
"elasticloadbalancing:ModifyLoadBalancerAttributes",
88+
"elasticloadbalancing:RegisterInstancesWithLoadBalancer",
89+
"elasticloadbalancing:DeregisterInstancesFromLoadBalancer",
90+
"elasticloadbalancing:RemoveTags",
91+
"elasticloadbalancing:SetSubnets",
92+
"elasticloadbalancing:ModifyTargetGroupAttributes",
93+
"elasticloadbalancing:CreateTargetGroup",
94+
"elasticloadbalancing:DescribeListeners",
95+
"elasticloadbalancing:CreateListener",
96+
"elasticloadbalancing:DescribeTargetHealth",
97+
"elasticloadbalancing:RegisterTargets",
98+
"elasticloadbalancing:DeleteListener",
99+
"autoscaling:DescribeAutoScalingGroups",
100+
"autoscaling:DescribeInstanceRefreshes",
101+
"ec2:CreateLaunchTemplate",
102+
"ec2:CreateLaunchTemplateVersion",
103+
"ec2:DescribeLaunchTemplates",
104+
"ec2:DescribeLaunchTemplateVersions",
105+
"ec2:DeleteLaunchTemplate",
106+
"ec2:DeleteLaunchTemplateVersions",
107+
"ec2:DescribeKeyPairs",
108+
"aws-marketplace:MeterUsage",
109+
"ec2:DescribeAvailabilityZones",
110+
"ec2:DescribeRegions",
111+
"eks:DescribeNodegroup",
112+
"eks:DescribeCluster",
113+
"eks:ListClusters",
114+
"eks:DescribeClusterVersions",
115+
"sts:GetCallerIdentity",
116+
"servicequotas:ListServiceQuotas",
117+
"iam:ListRoles"
118+
],
119+
"Resource": "*",
120+
"Effect": "Allow"
121+
},
122+
{
123+
"Action": [
124+
"eks:*"
125+
],
126+
"Resource": [
127+
"arn:aws:eks:*:*:cluster/*",
128+
"arn:aws:eks:*:*:nodegroup/*",
129+
"arn:aws:eks:*:*:addon/*",
130+
"arn:aws:eks:*:*:fargateprofile/*",
131+
"arn:aws:eks:*:*:identityproviderconfig/*",
132+
"arn:aws:eks:*:*:eks-anywhere-subscription/*",
133+
"arn:aws:eks:*:*:podidentityassociation/*",
134+
"arn:aws:eks:*:*:access-entry/*",
135+
"arn:aws:eks:*:aws:cluster-access-policy/*"
136+
],
137+
"Effect": "Allow"
138+
},
139+
{
140+
"Action": [
141+
"iam:ListOpenIDConnectProviderTags",
142+
"iam:GetOpenIDConnectProvider",
143+
"iam:CreateOpenIDConnectProvider",
144+
"iam:DeleteOpenIDConnectProvider",
145+
"iam:TagOpenIDConnectProvider",
146+
"iam:UntagOpenIDConnectProvider",
147+
"iam:UpdateOpenIDConnectProviderThumbprint"
148+
],
149+
"Resource": [
150+
"arn:*:iam::*:oidc-provider/oidc.eks*"
151+
],
152+
"Effect": "Allow"
153+
}
154+
]
155+
}

0 commit comments

Comments
 (0)