🤖 Generated by the Daily AI Engineer
Problem
Platform#2326 cannot declare the GitHub OIDC provider and EKS CI role yet: the Upbound AWS provider uses SafeStart, so the two required namespaced IAM managed-resource definitions are inactive and the aws tenant ServiceAccount has no permission to apply them.
Proposed direction
Activate only OpenIDConnectProvider and Role for provider-aws-iam v2.6.1, then grant the aws ServiceAccount namespace-local CRUD for exactly those resources. The role can carry its least-privilege permissions as a managed inline policy, avoiding separate Policy and attachment CRDs. Keep the tenant artifact empty in this slice, so merging creates no AWS resources; the follow-up identity manifests remain the activation checkpoint.
Acceptance criteria
Part of #2326.
Rough size: S.
Problem
Platform#2326 cannot declare the GitHub OIDC provider and EKS CI role yet: the Upbound AWS provider uses SafeStart, so the two required namespaced IAM managed-resource definitions are inactive and the
awstenant ServiceAccount has no permission to apply them.Proposed direction
Activate only
OpenIDConnectProviderandRolefor provider-aws-iam v2.6.1, then grant theawsServiceAccount namespace-local CRUD for exactly those resources. The role can carry its least-privilege permissions as a managed inline policy, avoiding separatePolicyand attachment CRDs. Keep the tenant artifact empty in this slice, so merging creates no AWS resources; the follow-up identity manifests remain the activation checkpoint.Acceptance criteria
ManagedResourceActivationPolicyactivates exactly the two namespaced IAM MRDs needed by platform#2326.awsServiceAccount only those two resource kinds and standard reconciliation verbs.Part of #2326.
Rough size: S.