Skip to content

Commit 13ee091

Browse files
kahootalimax-rocket-internet
kahootali
authored and
max-rocket-internet
committed
add doc for iam permission (#511)
* add doc for minimum iam permission Signed-off-by: kahootali <[email protected]> * refer iam doc in readme Signed-off-by: kahootali <[email protected]> * remove iam permissions from examples * set alphabetically the iam permissons
1 parent 2b88e50 commit 13ee091

File tree

3 files changed

+123
-111
lines changed

3 files changed

+123
-111
lines changed

‎README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -51,6 +51,7 @@ module "my-cluster" {
5151
* [Autoscaling](https://github.com/terraform-aws-modules/terraform-aws-eks/blob/master/docs/autoscaling.md): How to enable worker node autoscaling.
5252
* [Enable Docker Bridge Network](https://github.com/terraform-aws-modules/terraform-aws-eks/blob/master/docs/enable-docker-bridge-network.md): How to enable the docker bridge network when using the EKS-optimized AMI, which disables it by default.
5353
* [Spot instances](https://github.com/terraform-aws-modules/terraform-aws-eks/blob/master/docs/spot-instances.md): How to use spot instances with this module.
54+
* [IAM Permissions](https://github.com/terraform-aws-modules/terraform-aws-eks/blob/master/docs/iam-permissions.md): Minimum IAM permissions needed to setup EKS Cluster.
5455

5556
## Release schedule
5657

‎docs/iam-permissions.md

Lines changed: 121 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,121 @@
1+
# IAM Permissions
2+
3+
Following IAM permissions are the minimum permissions needed for your IAM user or IAM role to create an EKS cluster.
4+
5+
```json
6+
{
7+
"Version": "2012-10-17",
8+
"Statement": [
9+
{
10+
"Sid": "VisualEditor0",
11+
"Effect": "Allow",
12+
"Action": [
13+
"autoscaling:AttachInstances",
14+
"autoscaling:CreateAutoScalingGroup",
15+
"autoscaling:CreateLaunchConfiguration",
16+
"autoscaling:CreateOrUpdateTags",
17+
"autoscaling:DeleteAutoScalingGroup",
18+
"autoscaling:DeleteLaunchConfiguration",
19+
"autoscaling:DeleteTags",
20+
"autoscaling:Describe*",
21+
"autoscaling:DetachInstances",
22+
"autoscaling:SetDesiredCapacity",
23+
"autoscaling:UpdateAutoScalingGroup",
24+
"autoscaling:SuspendProcesses",
25+
"ec2:AllocateAddress",
26+
"ec2:AssignPrivateIpAddresses",
27+
"ec2:Associate*",
28+
"ec2:AttachInternetGateway",
29+
"ec2:AttachNetworkInterface",
30+
"ec2:AuthorizeSecurityGroupEgress",
31+
"ec2:AuthorizeSecurityGroupIngress",
32+
"ec2:CreateDefaultSubnet",
33+
"ec2:CreateDhcpOptions",
34+
"ec2:CreateEgressOnlyInternetGateway",
35+
"ec2:CreateInternetGateway",
36+
"ec2:CreateNatGateway",
37+
"ec2:CreateNetworkInterface",
38+
"ec2:CreateRoute",
39+
"ec2:CreateRouteTable",
40+
"ec2:CreateSecurityGroup",
41+
"ec2:CreateSubnet",
42+
"ec2:CreateTags",
43+
"ec2:CreateVolume",
44+
"ec2:CreateVpc",
45+
"ec2:DeleteDhcpOptions",
46+
"ec2:DeleteEgressOnlyInternetGateway",
47+
"ec2:DeleteInternetGateway",
48+
"ec2:DeleteNatGateway",
49+
"ec2:DeleteNetworkInterface",
50+
"ec2:DeleteRoute",
51+
"ec2:DeleteRouteTable",
52+
"ec2:DeleteSecurityGroup",
53+
"ec2:DeleteSubnet",
54+
"ec2:DeleteTags",
55+
"ec2:DeleteVolume",
56+
"ec2:DeleteVpc",
57+
"ec2:DeleteVpnGateway",
58+
"ec2:Describe*",
59+
"ec2:DetachInternetGateway",
60+
"ec2:DetachNetworkInterface",
61+
"ec2:DetachVolume",
62+
"ec2:Disassociate*",
63+
"ec2:ModifySubnetAttribute",
64+
"ec2:ModifyVpcAttribute",
65+
"ec2:ModifyVpcEndpoint",
66+
"ec2:ReleaseAddress",
67+
"ec2:RevokeSecurityGroupEgress",
68+
"ec2:RevokeSecurityGroupIngress",
69+
"ec2:UpdateSecurityGroupRuleDescriptionsEgress",
70+
"ec2:UpdateSecurityGroupRuleDescriptionsIngress",
71+
"ec2:CreateLaunchTemplate",
72+
"ec2:CreateLaunchTemplateVersion",
73+
"ec2:DeleteLaunchTemplate",
74+
"ec2:DeleteLaunchTemplateVersions",
75+
"ec2:DescribeLaunchTemplates",
76+
"ec2:DescribeLaunchTemplateVersions",
77+
"ec2:GetLaunchTemplateData",
78+
"ec2:ModifyLaunchTemplate",
79+
"ec2:RunInstances",
80+
"eks:CreateCluster",
81+
"eks:DeleteCluster",
82+
"eks:DescribeCluster",
83+
"eks:ListClusters",
84+
"eks:UpdateClusterConfig",
85+
"eks:DescribeUpdate",
86+
"iam:AddRoleToInstanceProfile",
87+
"iam:AttachRolePolicy",
88+
"iam:CreateInstanceProfile",
89+
"iam:CreateServiceLinkedRole",
90+
"iam:CreatePolicy",
91+
"iam:CreatePolicyVersion",
92+
"iam:CreateRole",
93+
"iam:DeleteInstanceProfile",
94+
"iam:DeletePolicy",
95+
"iam:DeleteRole",
96+
"iam:DeleteRolePolicy",
97+
"iam:DeleteServiceLinkedRole",
98+
"iam:DetachRolePolicy",
99+
"iam:GetInstanceProfile",
100+
"iam:GetPolicy",
101+
"iam:GetPolicyVersion",
102+
"iam:GetRole",
103+
"iam:GetRolePolicy",
104+
"iam:List*",
105+
"iam:PassRole",
106+
"iam:PutRolePolicy",
107+
"iam:RemoveRoleFromInstanceProfile",
108+
"iam:TagRole",
109+
"iam:UpdateAssumeRolePolicy",
110+
// Following permissions are needed if cluster_enabled_log_types is enabled
111+
"logs:CreateLogGroup",
112+
"logs:DescribeLogGroups",
113+
"logs:DeleteLogGroup",
114+
"logs:ListTagsLogGroup",
115+
"logs:PutRetentionPolicy"
116+
],
117+
"Resource": "*"
118+
}
119+
]
120+
}
121+
```

‎examples/README.md

Lines changed: 1 addition & 111 deletions
Original file line numberDiff line numberDiff line change
@@ -8,114 +8,4 @@ These serve a few purposes:
88

99
## IAM Permissions
1010

11-
The following IAM policy is the minimum needed to execute the module from the test suite.
12-
13-
```json
14-
{
15-
"Version": "2012-10-17",
16-
"Statement": [
17-
{
18-
"Sid": "VisualEditor0",
19-
"Effect": "Allow",
20-
"Action": [
21-
"autoscaling:AttachInstances",
22-
"autoscaling:CreateAutoScalingGroup",
23-
"autoscaling:CreateLaunchConfiguration",
24-
"autoscaling:CreateOrUpdateTags",
25-
"autoscaling:DeleteAutoScalingGroup",
26-
"autoscaling:DeleteLaunchConfiguration",
27-
"autoscaling:DeleteTags",
28-
"autoscaling:Describe*",
29-
"autoscaling:DetachInstances",
30-
"autoscaling:SetDesiredCapacity",
31-
"autoscaling:UpdateAutoScalingGroup",
32-
"autoscaling:SuspendProcesses",
33-
"ec2:AllocateAddress",
34-
"ec2:AssignPrivateIpAddresses",
35-
"ec2:Associate*",
36-
"ec2:AttachInternetGateway",
37-
"ec2:AttachNetworkInterface",
38-
"ec2:AuthorizeSecurityGroupEgress",
39-
"ec2:AuthorizeSecurityGroupIngress",
40-
"ec2:CreateDefaultSubnet",
41-
"ec2:CreateDhcpOptions",
42-
"ec2:CreateEgressOnlyInternetGateway",
43-
"ec2:CreateInternetGateway",
44-
"ec2:CreateNatGateway",
45-
"ec2:CreateNetworkInterface",
46-
"ec2:CreateRoute",
47-
"ec2:CreateRouteTable",
48-
"ec2:CreateSecurityGroup",
49-
"ec2:CreateSubnet",
50-
"ec2:CreateTags",
51-
"ec2:CreateVolume",
52-
"ec2:CreateVpc",
53-
"ec2:DeleteDhcpOptions",
54-
"ec2:DeleteEgressOnlyInternetGateway",
55-
"ec2:DeleteInternetGateway",
56-
"ec2:DeleteNatGateway",
57-
"ec2:DeleteNetworkInterface",
58-
"ec2:DeleteRoute",
59-
"ec2:DeleteRouteTable",
60-
"ec2:DeleteSecurityGroup",
61-
"ec2:DeleteSubnet",
62-
"ec2:DeleteTags",
63-
"ec2:DeleteVolume",
64-
"ec2:DeleteVpc",
65-
"ec2:DeleteVpnGateway",
66-
"ec2:Describe*",
67-
"ec2:DetachInternetGateway",
68-
"ec2:DetachNetworkInterface",
69-
"ec2:DetachVolume",
70-
"ec2:Disassociate*",
71-
"ec2:ModifySubnetAttribute",
72-
"ec2:ModifyVpcAttribute",
73-
"ec2:ModifyVpcEndpoint",
74-
"ec2:ReleaseAddress",
75-
"ec2:RevokeSecurityGroupEgress",
76-
"ec2:RevokeSecurityGroupIngress",
77-
"ec2:UpdateSecurityGroupRuleDescriptionsEgress",
78-
"ec2:UpdateSecurityGroupRuleDescriptionsIngress",
79-
"ec2:CreateLaunchTemplate",
80-
"ec2:CreateLaunchTemplateVersion",
81-
"ec2:DeleteLaunchTemplate",
82-
"ec2:DeleteLaunchTemplateVersions",
83-
"ec2:DescribeLaunchTemplates",
84-
"ec2:DescribeLaunchTemplateVersions",
85-
"ec2:GetLaunchTemplateData",
86-
"ec2:ModifyLaunchTemplate",
87-
"ec2:RunInstances",
88-
"eks:CreateCluster",
89-
"eks:DeleteCluster",
90-
"eks:DescribeCluster",
91-
"eks:ListClusters",
92-
"eks:UpdateClusterConfig",
93-
"eks:DescribeUpdate",
94-
"iam:AddRoleToInstanceProfile",
95-
"iam:AttachRolePolicy",
96-
"iam:CreateInstanceProfile",
97-
"iam:CreatePolicy",
98-
"iam:CreatePolicyVersion",
99-
"iam:CreateRole",
100-
"iam:DeleteInstanceProfile",
101-
"iam:DeletePolicy",
102-
"iam:DeleteRole",
103-
"iam:DeleteRolePolicy",
104-
"iam:DeleteServiceLinkedRole",
105-
"iam:DetachRolePolicy",
106-
"iam:GetInstanceProfile",
107-
"iam:GetPolicy",
108-
"iam:GetPolicyVersion",
109-
"iam:GetRole",
110-
"iam:GetRolePolicy",
111-
"iam:List*",
112-
"iam:PassRole",
113-
"iam:PutRolePolicy",
114-
"iam:RemoveRoleFromInstanceProfile",
115-
"iam:UpdateAssumeRolePolicy"
116-
],
117-
"Resource": "*"
118-
}
119-
]
120-
}
121-
```
11+
You can see the minimum IAM Permissions required [here](https://github.com/terraform-aws-modules/terraform-aws-eks/blob/master/docs/iam-permissions.md).

0 commit comments

Comments
 (0)