Merge pull request #7451 from teraflik/patch-1

Update well-known policy for ebsCSIController
eksctl-io · Jan 22, 2024 · b4d258d · b4d258d
2 parents 37cc928 + b4b8935
commit b4d258d
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 26 deletions.
diff --git a/pkg/cfn/builder/iam_test.go b/pkg/cfn/builder/iam_test.go
@@ -545,18 +545,6 @@ const expectedEbsPolicyDocument = `{
 	  "Effect": "Allow",
 	  "Resource": "*"
 	},
-	{
-	  "Action": [
-		"ec2:CreateVolume"
-	  ],
-	  "Condition": {
-		"StringLike": {
-		  "aws:RequestTag/kubernetes.io/cluster/*": "owned"
-		}
-	  },
-	  "Effect": "Allow",
-	  "Resource": "*"
-	},
 	{
 	  "Action": [
 		"ec2:DeleteVolume"
@@ -587,7 +575,7 @@ const expectedEbsPolicyDocument = `{
 	  ],
 	  "Condition": {
 		"StringLike": {
-		  "ec2:ResourceTag/kubernetes.io/cluster/*": "owned"
+		  "ec2:ResourceTag/kubernetes.io/created-for/pvc/name": "*"
 		}
 	  },
 	  "Effect": "Allow",

diff --git a/pkg/cfn/builder/statement.go b/pkg/cfn/builder/statement.go
@@ -457,18 +457,6 @@ func ebsStatements() []cft.MapOfInterfaces {
 				},
 			},
 		},
-		{
-			"Effect": "Allow",
-			"Action": []string{
-				"ec2:CreateVolume",
-			},
-			"Resource": "*",
-			"Condition": cft.MapOfInterfaces{
-				"StringLike": cft.MapOfInterfaces{
-					"aws:RequestTag/kubernetes.io/cluster/*": "owned",
-				},
-			},
-		},
 		{
 			"Effect": "Allow",
 			"Action": []string{
@@ -502,7 +490,7 @@ func ebsStatements() []cft.MapOfInterfaces {
 			"Resource": "*",
 			"Condition": cft.MapOfInterfaces{
 				"StringLike": cft.MapOfInterfaces{
-					"ec2:ResourceTag/kubernetes.io/cluster/*": "owned",
+					"ec2:ResourceTag/kubernetes.io/created-for/pvc/name": "*",
 				},
 			},
 		},