kubernetes / kubernetes/cloud-provider-aws
Tighten IAM Permissions
- Dominant language
- Go
- Stars
- 465
- Forks
- 393
- Avg merge
- 22h 25m
- Merged PRs (30d)
- 11
Description
Related to https://github.com/kubernetes-sigs/cluster-api-provider-aws/issues/608
**What would you like to be added**:
[Cluster API Provider AWS](https://github.com/kubernetes-sigs/cluster-api-provider-aws/blob/master/pkg/cloud/aws/services/cloudformation/bootstrap.go) attempts to use least privileges whereever possible.
The project maintains a copy of the IAM policies used by cloud-provider-aws, but these are permissive compared to the use of IAM conditions in the Cluster API AWS.
If there is consistent tagging in use, then these permissions can be scoped down.
**Why is this needed**:
Enhanced security posture.
/kind feature
Contributor guide
Research direction
Start with the related issue at kubernetes-sigs/cluster-api-provider-aws#608 and the referenced pkg/cloud/aws/services/cloudformation/bootstrap.go entry point. Compare the cloud-provider-aws IAM policies with the conditions and consistent tagging described in the issue; done means the maintained permissions are scoped down while supporting the existing usage.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, go
- Domain
- cloud, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100