STOR-2918: update AWS EBS CSI credentials request policy to mirror upstream

[dfajmon]

Update AWS EBS credentials policy to be aligned with upstream changes. Extra added KMS encryption policy based on
https://github.com/kubernetes-sigs/aws-ebs-csi-driver/blob/master/docs/install.md

Coordination checklist

This CredentialsRequest change must be reflected in the following places before merging:

• ROSA HCP managed policy — follow the update process: https://source.redhat.com/departments/products_and_global_engineering/sre/wiki/aws_managed_policy_requirements_process_for_rosa_hcp
• HyperShift IAM role — https://github.com/openshift/hypershift/blob/5e182bedfbda84fc65f5b6d41640d55b2ed1d33b/cmd/infra/aws/iam.go#L96
• STS / manual-mode IAM policies (if applicable)
• Release notes

Summary by CodeRabbit

• Bug Fixes
  • Tightened AWS permissions for the EBS CSI driver by narrowing EC2 access to only the required describe, volume/snapshot lifecycle, and attachment/detachment actions.
  • Restricted operations to more specific resource patterns and added tag-based conditions to limit which cluster/storage resources are eligible.
  • Reduced KMS permissions to only the necessary decrypt, data key generation, and grant creation actions, improving overall security.

[openshift-ci-robot]

@dfajmon: This pull request references STOR-2918 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target only the "5.0.0" version, but multiple target versions were set.

Details

In response to this:

Update AWS EBS credentials policy to be aligned with upstream changes. Extra added KMS encryption policy based on
https://github.com/kubernetes-sigs/aws-ebs-csi-driver/blob/master/docs/install.md

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

Walkthrough

The AWS CredentialsRequest manifest replaces broad EC2 and KMS IAM permissions for aws-ebs-csi-driver-operator with action-specific statements, ARN scoping, and tag-based conditions.

Changes

AWS IAM policy scoping

Layer / File(s)	Summary
EC2 describe, create, copy, and snapshot manifests/03_credentials_request_aws.yaml	Explicit EC2 describe actions are listed, and CreateVolume, CopyVolumes, and CreateSnapshot are split into scoped Allow statements with resource and tag conditions.
EC2 volume and snapshot operations manifests/03_credentials_request_aws.yaml	Volume mutation, attachment, fast snapshot restore, snapshot deletion, and lock permissions are narrowed to volume, instance, and snapshot ARN patterns with tag conditions.
EC2 tagging permissions manifests/03_credentials_request_aws.yaml	CreateTags and DeleteTags are constrained by create-action context, cluster resource tags, and tag key restrictions.
KMS permission narrowing manifests/03_credentials_request_aws.yaml	KMS permissions are reduced to Decrypt, GenerateDataKeyWithoutPlaintext, and CreateGrant on key ARNs with a grant-for-AWS-resource condition.

Estimated code review effort: 3 (Moderate) | ~25 minutes

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	Only manifests/03_credentials_request_aws.yaml changed; no Ginkgo test files or titles were added or modified.
Test Structure And Quality	✅ Passed	The PR only changes manifests; no Ginkgo tests were added or modified, so the test-structure checklist is not applicable.
Microshift Test Compatibility	✅ Passed	PR only changes a YAML CredentialsRequest manifest; no Ginkgo e2e tests or MicroShift-sensitive APIs were added.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	PR only changes an AWS CredentialsRequest manifest; no Ginkgo tests or SNO/topology assumptions were added.
Topology-Aware Scheduling Compatibility	✅ Passed	The only changed file is an AWS CredentialsRequest IAM policy; no pods, replicas, affinities, nodeSelectors, tolerations, or PDBs were added.
Ote Binary Stdout Contract	✅ Passed	PR only changes a YAML credentials manifest; no Go/test entrypoint code or stdout writes were added.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	PR changes only the AWS credentials manifest; no new Ginkgo e2e tests or IPv4/public-network code paths were added.
No-Weak-Crypto	✅ Passed	The PR only edits an AWS IAM/KMS policy YAML; it adds no weak algorithms, custom crypto, or secret comparisons.
Container-Privileges	✅ Passed	The only AWS manifest changed is a CredentialsRequest policy file; it contains no privileged, host*, SYS_ADMIN, or allowPrivilegeEscalation settings.
No-Sensitive-Data-In-Logs	✅ Passed	The changed AWS credentials manifest has IAM policy entries and a secretRef, but no log statements or sensitive literals exposing secrets/PII.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: aligning the AWS EBS CSI credentials request policy with upstream.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

manifests/03_credentials_request_aws.yaml (1)

1-5: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

Action required — add the CredentialsRequest coordination note

This CredentialsRequest change needs a PR-description note covering the operator repo, STS/manual-mode IAM policies, CCO, and release notes.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@manifests/03_credentials_request_aws.yaml` around lines 1 - 5, Add the
missing CredentialsRequest coordination note to the PR description, covering
that this change must be reflected in the operator repo, STS/manual-mode IAM
policies, CCO, and release notes. Update the relevant CredentialsRequest-related
documentation/comment guidance so reviewers can find the coordination
requirements tied to the existing ROSA update process reference and the IAM role
sync note.

Source: Coding guidelines

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@manifests/03_credentials_request_aws.yaml`:
- Around line 150-154: The KMS permissions statement currently grants
kms:CreateGrant too broadly alongside decrypt and data key actions. Split
kms:CreateGrant into its own IAM statement in
manifests/03_credentials_request_aws.yaml and add a Bool condition on
kms:GrantIsForAWSResource set to true, keeping the existing key resource scope
and leaving the other KMS actions in the original statement.

---

Outside diff comments:
In `@manifests/03_credentials_request_aws.yaml`:
- Around line 1-5: Add the missing CredentialsRequest coordination note to the
PR description, covering that this change must be reflected in the operator
repo, STS/manual-mode IAM policies, CCO, and release notes. Update the relevant
CredentialsRequest-related documentation/comment guidance so reviewers can find
the coordination requirements tied to the existing ROSA update process reference
and the IAM role sync note.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 135fde91-46f6-4100-b066-0c4c836ca363

📥 Commits

Reviewing files that changed from the base of the PR and between cb5069a and 05fd0d3.

📒 Files selected for processing (1)

• manifests/03_credentials_request_aws.yaml

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: dfajmon

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [dfajmon]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[dfajmon]

/retest

[dfajmon]

/retest

[openshift-ci]

@dfajmon: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-aws-ovn-upgrade	0e6cc0d	link	true	/test e2e-aws-ovn-upgrade
ci/prow/e2e-aws-csi	0e6cc0d	link	true	/test e2e-aws-csi

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.