Merge pull request #67710 from xJustin/OSDOCS-8066-S3-install-permissions

Author: kcarmichael08

modules/rosa-sts-account-wide-roles-and-policies.adoc

@@ -131,6 +131,7 @@ The account number present in the `sts_installer_trust_policy.json` and `sts_sup
                 "ec2:DescribeInstanceCreditSpecifications",
                 "ec2:DescribeInstances",
                 "ec2:DescribeInstanceStatus",
+                "ec2:DescribeInstanceTypeOfferings",
                 "ec2:DescribeInstanceTypes",
                 "ec2:DescribeInternetGateways",
                 "ec2:DescribeKeyPairs",
@@ -142,6 +143,7 @@ The account number present in the `sts_installer_trust_policy.json` and `sts_sup
                 "ec2:DescribeReservedInstancesOfferings",
                 "ec2:DescribeRouteTables",
                 "ec2:DescribeSecurityGroups",
+                "ec2:DescribeSecurityGroupRules",
                 "ec2:DescribeSubnets",
                 "ec2:DescribeTags",
                 "ec2:DescribeVolumes",
@@ -178,6 +180,7 @@ The account number present in the `sts_installer_trust_policy.json` and `sts_sup
                 "elasticloadbalancing:DeleteTargetGroup",
                 "elasticloadbalancing:DeregisterInstancesFromLoadBalancer",
                 "elasticloadbalancing:DeregisterTargets",
+                "elasticloadbalancing:DescribeAccountLimits",
                 "elasticloadbalancing:DescribeInstanceHealth",
                 "elasticloadbalancing:DescribeListeners",
                 "elasticloadbalancing:DescribeLoadBalancerAttributes",
@@ -196,6 +199,7 @@ The account number present in the `sts_installer_trust_policy.json` and `sts_sup
                 "iam:CreateInstanceProfile",
                 "iam:DeleteInstanceProfile",
                 "iam:GetInstanceProfile",
+                "iam:TagInstanceProfile",
                 "iam:GetRole",
                 "iam:GetRolePolicy",
                 "iam:GetUser",
@@ -215,6 +219,7 @@ The account number present in the `sts_installer_trust_policy.json` and `sts_sup
                 "route53:ChangeTagsForResource",
                 "route53:CreateHostedZone",
                 "route53:DeleteHostedZone",
+                "route53:GetAccountLimit",
                 "route53:GetChange",
                 "route53:GetHostedZone",
                 "route53:ListHostedZones",
@@ -225,12 +230,14 @@ The account number present in the `sts_installer_trust_policy.json` and `sts_sup
                 "s3:CreateBucket",
                 "s3:DeleteBucket",
                 "s3:DeleteObject",
+                "s3:DeleteObjectVersion",
                 "s3:GetAccelerateConfiguration",
                 "s3:GetBucketAcl",
                 "s3:GetBucketCORS",
                 "s3:GetBucketLocation",
                 "s3:GetBucketLogging",
                 "s3:GetBucketObjectLockConfiguration",
+                "s3:GetBucketPolicy",
                 "s3:GetBucketReplication",
                 "s3:GetBucketRequestPayment",
                 "s3:GetBucketTagging",
@@ -247,6 +254,7 @@ The account number present in the `sts_installer_trust_policy.json` and `sts_sup
                 "s3:ListBucketVersions",
                 "s3:PutBucketAcl",
                 "s3:PutBucketTagging",
+                "s3:PutBucketVersioning",
                 "s3:PutEncryptionConfiguration",
                 "s3:PutObject",
                 "s3:PutObjectAcl",
@@ -263,11 +271,23 @@ The account number present in the `sts_installer_trust_policy.json` and `sts_sup
                 "ec2:DescribeVpcEndpointServiceConfigurations",
                 "ec2:DescribeVpcEndpointServicePermissions",
                 "ec2:DescribeVpcEndpointServices",
-                "ec2:ModifyVpcEndpointServicePermissions"
+                "ec2:ModifyVpcEndpointServicePermissions",
                 "kms:DescribeKey",
                 "cloudwatch:GetMetricData"
             ],
             "Resource": "*"
+        },
+        {
+            "Effect": "Allow",
+            "Action": [
+                "secretsmanager:GetSecretValue"
+            ],
+            "Resource": "*",
+            "Condition": {
+                "StringEquals": {
+                    "aws:ResourceTag/red-hat-managed": "true"
+                }
+            }
         }
     ]
 }