Merge pull request #36416 from codyhoag/aws-permissions-updates

OSDOCS-2372 AWS permission updates

Author: codyhoag

modules/installation-aws-permissions.adoc

@@ -14,8 +14,6 @@ cluster, the IAM user requires the following permissions:
 .Required EC2 permissions for installation
 [%collapsible]
 ====
-* `ec2:AllocateAddress`
-* `ec2:AssociateAddress`
 * `ec2:AuthorizeSecurityGroupEgress`
 * `ec2:AuthorizeSecurityGroupIngress`
 * `ec2:CopyImage`
@@ -57,7 +55,6 @@ cluster, the IAM user requires the following permissions:
 * `ec2:GetEbsDefaultKmsKeyId`
 * `ec2:ModifyInstanceAttribute`
 * `ec2:ModifyNetworkInterfaceAttribute`
-* `ec2:ReleaseAddress`
 * `ec2:RevokeSecurityGroupEgress`
 * `ec2:RevokeSecurityGroupIngress`
 * `ec2:RunInstances`
@@ -67,6 +64,8 @@ cluster, the IAM user requires the following permissions:
 .Required permissions for creating network resources during installation
 [%collapsible]
 ====
+* `ec2:AllocateAddress`
+* `ec2:AssociateAddress`
 * `ec2:AssociateDhcpOptions`
 * `ec2:AssociateRouteTable`
 * `ec2:AttachInternetGateway`
@@ -230,6 +229,7 @@ If you have not created an elastic load balancer (ELB) in your AWS account, the
 * `ec2:DeleteVpcEndpoints`
 * `ec2:DetachInternetGateway`
 * `ec2:DisassociateRouteTable`
+* `ec2:ReleaseAddress`
 * `ec2:ReplaceRouteTableAssociation`
 
 [NOTE]
@@ -238,6 +238,12 @@ If you use an existing VPC, your account does not require these permissions to d
 =====
 ====
 
+.Required permissions to delete a cluster with shared instance roles
+[%collapsible]
+====
+* `iam:UntagRole`
+====
+
 .Additional IAM and S3 permissions that are required to create manifests
 [%collapsible]
 ====