STOR-2918: update AWS EBS CSI credentials request policy to mirror upstream

manifests/03_credentials_request_aws.yaml

@@ -26,38 +26,133 @@ spec:
     statementEntries:
     - effect: Allow
       action:
-      - ec2:AttachVolume
-      - ec2:CreateSnapshot
-      - ec2:CreateTags
-      - ec2:CreateVolume
-      - ec2:DeleteSnapshot
-      - ec2:DeleteTags
-      - ec2:DeleteVolume
+      - ec2:DescribeAvailabilityZones
       - ec2:DescribeInstances
+      - ec2:DescribeInstanceTypes
       - ec2:DescribeSnapshots
-      - ec2:DescribeTags
       - ec2:DescribeVolumes
       - ec2:DescribeVolumesModifications
+      - ec2:DescribeVolumeStatus
+      resource: "*"
+    - effect: Allow
+      action:
+      - ec2:CreateVolume
+      - ec2:CopyVolumes
+      resource: "arn:aws:ec2:*:*:volume/*"
+      policyCondition:
+        StringEquals:
+          "aws:RequestTag/ebs.csi.aws.com/cluster": "true"
+    - effect: Allow
+      action:
+      - ec2:CopyVolumes
+      resource: "arn:aws:ec2:*:*:volume/vol-*"
+      policyCondition:
+        StringEquals:
+          "ec2:ResourceTag/ebs.csi.aws.com/cluster": "true"
+    - effect: Allow
+      action:
+      - ec2:CopyVolumes
+      resource: "arn:aws:ec2:*:*:volume/vol-*"
+      policyCondition:
+        StringLike:
+          "ec2:ResourceTag/kubernetes.io/created-for/pvc/name": "*"
+    - effect: Allow
+      action:
+      - ec2:CreateSnapshot
+      resource: "arn:aws:ec2:*:*:snapshot/*"
+      policyCondition:
+        StringEquals:
+          "aws:RequestTag/ebs.csi.aws.com/cluster": "true"
+    - effect: Allow
+      action:
+      - ec2:CreateSnapshot
+      resource: "arn:aws:ec2:*:*:volume/*"
+      policyCondition:
+        StringEquals:
+          "ec2:ResourceTag/ebs.csi.aws.com/cluster": "true"
+    - effect: Allow
+      action:
+      - ec2:ModifyVolume
+      - ec2:AttachVolume
       - ec2:DetachVolume
+      - ec2:DeleteVolume
+      resource: "arn:aws:ec2:*:*:volume/*"
+      policyCondition:
+        StringEquals:
+          "ec2:ResourceTag/ebs.csi.aws.com/cluster": "true"
+    - effect: Allow
+      action:
       - ec2:ModifyVolume
-      - ec2:DescribeAvailabilityZones
+      - ec2:AttachVolume
+      - ec2:DetachVolume
+      - ec2:DeleteVolume
+      resource: "arn:aws:ec2:*:*:volume/*"
+      policyCondition:
+        StringLike:
+          "ec2:ResourceTag/kubernetes.io/created-for/pvc/name": "*"
+    - effect: Allow
+      action:
+      - ec2:CreateVolume
       - ec2:EnableFastSnapshotRestores
-      resource: "*"
+      resource: "arn:aws:ec2:*:*:snapshot/*"
+      policyCondition:
+        StringEquals:
+          "ec2:ResourceTag/ebs.csi.aws.com/cluster": "true"
+    - effect: Allow
+      action:
+      - ec2:AttachVolume
+      - ec2:DetachVolume
+      resource: "arn:aws:ec2:*:*:instance/*"
+    - effect: Allow
+      action:
+      - ec2:DeleteSnapshot
+      - ec2:LockSnapshot
+      resource: "arn:aws:ec2:*:*:snapshot/*"
+      policyCondition:
+        StringEquals:
+          "ec2:ResourceTag/ebs.csi.aws.com/cluster": "true"
+    - effect: Allow
+      action:
+      - ec2:CreateTags
+      resource: "arn:aws:ec2:*:*:volume/*"
+      policyCondition:
+        StringEquals:
+          "ec2:CreateAction":
+            - CreateVolume
+            - CreateSnapshot
+            - CopyVolumes
+    - effect: Allow
+      action:
+      - ec2:CreateTags
+      resource: "arn:aws:ec2:*:*:snapshot/*"
+      policyCondition:
+        StringEquals:
+          "ec2:CreateAction":
+            - CreateVolume
+            - CreateSnapshot
+            - CopyVolumes
+    - effect: Allow
+      action:
+      - ec2:CreateTags
+      - ec2:DeleteTags
+      resource: "arn:aws:ec2:*:*:volume/*"
+      policyCondition:
+        StringEquals:
+          "ec2:ResourceTag/ebs.csi.aws.com/cluster": "true"
+        "ForAllValues:StringNotEquals":
+          "aws:TagKeys":
+            - "ebs.csi.aws.com/cluster"
+            - "ebs.csi.aws.com/cluster-name"
+            - "kubernetes.io/created-for/pvc/name"
     - effect: Allow
       action:
-      - 'kms:ReEncrypt*'
       - kms:Decrypt
-      - kms:Encrypt
-      - kms:GenerateDataKey
-      - kms:GenerateDataKeyWithoutPlainText
-      - kms:DescribeKey
-      resource: '*'
+      - kms:GenerateDataKeyWithoutPlaintext
+      resource: "arn:aws:kms:*:*:key/*"
     - effect: Allow
       action:
-      - kms:RevokeGrant
       - kms:CreateGrant
-      - kms:ListGrants
-      resource: '*'
+      resource: "arn:aws:kms:*:*:key/*"
       policyCondition:
-        "Bool":
+        Bool:
           "kms:GrantIsForAWSResource": true