fix: Add missing Tag resource for efs-csi driver policy (#1573)

aws-ia · May 6, 2023 · 76df8c1 · 76df8c1
1 parent df164e9
commit 76df8c1
Showing 1 changed file with 13 additions and 0 deletions.
diff --git a/modules/kubernetes-addons/aws-efs-csi-driver/data.tf b/modules/kubernetes-addons/aws-efs-csi-driver/data.tf
@@ -37,6 +37,19 @@ data "aws_iam_policy_document" "aws_efs_csi_driver" {
     }
   }
 
+  statement {
+    sid       = "TagResource"
+    effect    = "Allow"
+    resources = ["arn:${var.addon_context.aws_partition_id}:elasticfilesystem:${var.addon_context.aws_region_name}:${var.addon_context.aws_caller_identity_account_id}:file-system/*"]
+    actions   = ["elasticfilesystem:TagResource"]
+
+    condition {
+      test     = "StringLike"
+      variable = "aws:RequestTag/efs.csi.aws.com/cluster"
+      values   = ["true"]
+    }
+  }
+
   statement {
     sid       = "AllowDeleteAccessPoint"
     effect    = "Allow"