fix: add missing IAM action for emptyRoutesDefaultVPCSecurityGroup option

darkweaver87 · darkweaver87 · commit 652f2b97a011 · 2025-02-10T11:02:48.000+01:00
diff --git a/cmd/clusterawsadm/cloudformation/bootstrap/cluster_api_controller.go b/cmd/clusterawsadm/cloudformation/bootstrap/cluster_api_controller.go
@@ -148,6 +148,7 @@ func (t Template) ControllersPolicy() *iamv1.PolicyDocument {
 				"ec2:ModifyNetworkInterfaceAttribute",
 				"ec2:ModifySubnetAttribute",
 				"ec2:ReleaseAddress",
+				"ec2:RevokeSecurityGroupEgress",
 				"ec2:RevokeSecurityGroupIngress",
 				"ec2:RunInstances",
 				"ec2:TerminateInstances",
diff --git a/cmd/clusterawsadm/cloudformation/bootstrap/fixtures/customsuffix.yaml b/cmd/clusterawsadm/cloudformation/bootstrap/fixtures/customsuffix.yaml
@@ -208,6 +208,7 @@ Resources:
           - ec2:ModifyNetworkInterfaceAttribute
           - ec2:ModifySubnetAttribute
           - ec2:ReleaseAddress
+          - ec2:RevokeSecurityGroupEgress
           - ec2:RevokeSecurityGroupIngress
           - ec2:RunInstances
           - ec2:TerminateInstances
diff --git a/cmd/clusterawsadm/cloudformation/bootstrap/fixtures/default.yaml b/cmd/clusterawsadm/cloudformation/bootstrap/fixtures/default.yaml
@@ -208,6 +208,7 @@ Resources:
           - ec2:ModifyNetworkInterfaceAttribute
           - ec2:ModifySubnetAttribute
           - ec2:ReleaseAddress
+          - ec2:RevokeSecurityGroupEgress
           - ec2:RevokeSecurityGroupIngress
           - ec2:RunInstances
           - ec2:TerminateInstances
diff --git a/cmd/clusterawsadm/cloudformation/bootstrap/fixtures/with_all_secret_backends.yaml b/cmd/clusterawsadm/cloudformation/bootstrap/fixtures/with_all_secret_backends.yaml
@@ -214,6 +214,7 @@ Resources:
           - ec2:ModifyNetworkInterfaceAttribute
           - ec2:ModifySubnetAttribute
           - ec2:ReleaseAddress
+          - ec2:RevokeSecurityGroupEgress
           - ec2:RevokeSecurityGroupIngress
           - ec2:RunInstances
           - ec2:TerminateInstances
diff --git a/cmd/clusterawsadm/cloudformation/bootstrap/fixtures/with_allow_assume_role.yaml b/cmd/clusterawsadm/cloudformation/bootstrap/fixtures/with_allow_assume_role.yaml
@@ -208,6 +208,7 @@ Resources:
           - ec2:ModifyNetworkInterfaceAttribute
           - ec2:ModifySubnetAttribute
           - ec2:ReleaseAddress
+          - ec2:RevokeSecurityGroupEgress
           - ec2:RevokeSecurityGroupIngress
           - ec2:RunInstances
           - ec2:TerminateInstances
diff --git a/cmd/clusterawsadm/cloudformation/bootstrap/fixtures/with_bootstrap_user.yaml b/cmd/clusterawsadm/cloudformation/bootstrap/fixtures/with_bootstrap_user.yaml
@@ -214,6 +214,7 @@ Resources:
           - ec2:ModifyNetworkInterfaceAttribute
           - ec2:ModifySubnetAttribute
           - ec2:ReleaseAddress
+          - ec2:RevokeSecurityGroupEgress
           - ec2:RevokeSecurityGroupIngress
           - ec2:RunInstances
           - ec2:TerminateInstances
diff --git a/cmd/clusterawsadm/cloudformation/bootstrap/fixtures/with_custom_bootstrap_user.yaml b/cmd/clusterawsadm/cloudformation/bootstrap/fixtures/with_custom_bootstrap_user.yaml
@@ -214,6 +214,7 @@ Resources:
           - ec2:ModifyNetworkInterfaceAttribute
           - ec2:ModifySubnetAttribute
           - ec2:ReleaseAddress
+          - ec2:RevokeSecurityGroupEgress
           - ec2:RevokeSecurityGroupIngress
           - ec2:RunInstances
           - ec2:TerminateInstances
diff --git a/cmd/clusterawsadm/cloudformation/bootstrap/fixtures/with_different_instance_profiles.yaml b/cmd/clusterawsadm/cloudformation/bootstrap/fixtures/with_different_instance_profiles.yaml
@@ -208,6 +208,7 @@ Resources:
           - ec2:ModifyNetworkInterfaceAttribute
           - ec2:ModifySubnetAttribute
           - ec2:ReleaseAddress
+          - ec2:RevokeSecurityGroupEgress
           - ec2:RevokeSecurityGroupIngress
           - ec2:RunInstances
           - ec2:TerminateInstances
diff --git a/cmd/clusterawsadm/cloudformation/bootstrap/fixtures/with_eks_console.yaml b/cmd/clusterawsadm/cloudformation/bootstrap/fixtures/with_eks_console.yaml
@@ -208,6 +208,7 @@ Resources:
           - ec2:ModifyNetworkInterfaceAttribute
           - ec2:ModifySubnetAttribute
           - ec2:ReleaseAddress
+          - ec2:RevokeSecurityGroupEgress
           - ec2:RevokeSecurityGroupIngress
           - ec2:RunInstances
           - ec2:TerminateInstances
diff --git a/cmd/clusterawsadm/cloudformation/bootstrap/fixtures/with_eks_default_roles.yaml b/cmd/clusterawsadm/cloudformation/bootstrap/fixtures/with_eks_default_roles.yaml
@@ -208,6 +208,7 @@ Resources:
           - ec2:ModifyNetworkInterfaceAttribute
           - ec2:ModifySubnetAttribute
           - ec2:ReleaseAddress
+          - ec2:RevokeSecurityGroupEgress
           - ec2:RevokeSecurityGroupIngress
           - ec2:RunInstances
           - ec2:TerminateInstances
diff --git a/cmd/clusterawsadm/cloudformation/bootstrap/fixtures/with_eks_disable.yaml b/cmd/clusterawsadm/cloudformation/bootstrap/fixtures/with_eks_disable.yaml
@@ -208,6 +208,7 @@ Resources:
           - ec2:ModifyNetworkInterfaceAttribute
           - ec2:ModifySubnetAttribute
           - ec2:ReleaseAddress
+          - ec2:RevokeSecurityGroupEgress
           - ec2:RevokeSecurityGroupIngress
           - ec2:RunInstances
           - ec2:TerminateInstances
diff --git a/cmd/clusterawsadm/cloudformation/bootstrap/fixtures/with_eks_kms_prefix.yaml b/cmd/clusterawsadm/cloudformation/bootstrap/fixtures/with_eks_kms_prefix.yaml
@@ -208,6 +208,7 @@ Resources:
           - ec2:ModifyNetworkInterfaceAttribute
           - ec2:ModifySubnetAttribute
           - ec2:ReleaseAddress
+          - ec2:RevokeSecurityGroupEgress
           - ec2:RevokeSecurityGroupIngress
           - ec2:RunInstances
           - ec2:TerminateInstances
diff --git a/cmd/clusterawsadm/cloudformation/bootstrap/fixtures/with_extra_statements.yaml b/cmd/clusterawsadm/cloudformation/bootstrap/fixtures/with_extra_statements.yaml
@@ -214,6 +214,7 @@ Resources:
           - ec2:ModifyNetworkInterfaceAttribute
           - ec2:ModifySubnetAttribute
           - ec2:ReleaseAddress
+          - ec2:RevokeSecurityGroupEgress
           - ec2:RevokeSecurityGroupIngress
           - ec2:RunInstances
           - ec2:TerminateInstances
diff --git a/cmd/clusterawsadm/cloudformation/bootstrap/fixtures/with_s3_bucket.yaml b/cmd/clusterawsadm/cloudformation/bootstrap/fixtures/with_s3_bucket.yaml
@@ -208,6 +208,7 @@ Resources:
           - ec2:ModifyNetworkInterfaceAttribute
           - ec2:ModifySubnetAttribute
           - ec2:ReleaseAddress
+          - ec2:RevokeSecurityGroupEgress
           - ec2:RevokeSecurityGroupIngress
           - ec2:RunInstances
           - ec2:TerminateInstances
diff --git a/cmd/clusterawsadm/cloudformation/bootstrap/fixtures/with_ssm_secret_backend.yaml b/cmd/clusterawsadm/cloudformation/bootstrap/fixtures/with_ssm_secret_backend.yaml
@@ -208,6 +208,7 @@ Resources:
           - ec2:ModifyNetworkInterfaceAttribute
           - ec2:ModifySubnetAttribute
           - ec2:ReleaseAddress
+          - ec2:RevokeSecurityGroupEgress
           - ec2:RevokeSecurityGroupIngress
           - ec2:RunInstances
           - ec2:TerminateInstances
