Merge pull request #4132 from ryan-dyer-sp/Issue-4046

4046 - Add AssumeRole and update appropriate tests

Author: k8s-ci-robot

cmd/clusterawsadm/api/bootstrap/v1alpha1/zz_generated.conversion.go

@@ -224,6 +224,9 @@ type AWSIAMConfigurationSpec struct {
 	// TODO: This field could be a pointer, but it seems it breaks setting default values?
 	// +optional
 	S3Buckets S3Buckets `json:"s3Buckets,omitempty"`
+
+	// AllowAssumeRole enables the sts:AssumeRole permission within the CAPA policies
+	AllowAssumeRole bool `json:"allowAssumeRole,omitempty"`
 }
 
 // GetObjectKind returns the AAWSIAMConfiguration's TypeMeta.

cmd/clusterawsadm/api/bootstrap/v1beta1/types.go

@@ -252,6 +252,15 @@ func (t Template) ControllersPolicy() *iamv1.PolicyDocument {
 			})
 		}
 	}
+	if t.Spec.AllowAssumeRole {
+		statement = append(statement, iamv1.StatementEntry{
+			Effect:   iamv1.EffectAllow,
+			Resource: t.allowedEC2InstanceProfiles(),
+			Action: iamv1.Actions{
+				"sts:AssumeRole",
+			},
+		})
+	}
 	if t.Spec.S3Buckets.Enable {
 		statement = append(statement, iamv1.StatementEntry{
 			Effect: iamv1.EffectAllow,