Add permissions for ELB to create service linked roles

cmd/clusterawsadm/cmd/alpha/bootstrap/BUILD

@@ -7,6 +7,7 @@ go_library(
     visibility = ["//visibility:public"],
     deps = [
         "//pkg/cloud/aws/services/cloudformation:go_default_library",
+        "//pkg/cloud/aws/services/iam:go_default_library",
         "//pkg/cloud/aws/services/sts:go_default_library",
         "//vendor/github.com/aws/aws-sdk-go/aws/session:go_default_library",
         "//vendor/github.com/aws/aws-sdk-go/service/cloudformation:go_default_library",

cmd/clusterawsadm/cmd/alpha/bootstrap/bootstrap.go

@@ -28,6 +28,7 @@ import (
 	awssts "github.com/aws/aws-sdk-go/service/sts"
 	"github.com/spf13/cobra"
 	"sigs.k8s.io/cluster-api-provider-aws/pkg/cloud/aws/services/cloudformation"
+	"sigs.k8s.io/cluster-api-provider-aws/pkg/cloud/aws/services/iam"
 	"sigs.k8s.io/cluster-api-provider-aws/pkg/cloud/aws/services/sts"
 )
 
@@ -106,7 +107,7 @@ Instructions for obtaining the AWS account ID can be found on https://docs.aws.a
 				return err
 			}
 
-			fmt.Print(string(j))
+			fmt.Print(iam.ProcessPolicyDocument(string(j)))
 			return nil
 		},
 	}

pkg/cloud/aws/services/cloudformation/bootstrap.go

@@ -188,6 +188,19 @@ func controllersPolicy(accountID string) *iam.PolicyDocument {
 					"elasticloadbalancing:RegisterInstancesWithLoadBalancer",
 				},
 			},
+			{
+				Effect: iam.EffectAllow,
+				Resource: iam.Resources{fmt.Sprintf(
+					"arn:aws:iam::%s:role/aws-service-role/elasticloadbalancing.amazonaws.com/AWSServiceRoleForElasticLoadBalancing",
+					accountID),
+				},
+				Action: iam.Actions{
+					"iam:CreateServiceLinkedRole",
+				},
+				Condition: iam.Conditions{
+					"StringLike": map[string]string{"iam:AWSServiceName": "elasticloadbalancing.amazonaws.com"},
+				},
+			},
 			{
 				Effect: iam.EffectAllow,
 				Resource: iam.Resources{fmt.Sprintf(
@@ -340,7 +353,7 @@ func (s *Service) ReconcileBootstrapStack(stackName string, accountID string) er
 		return errors.Wrap(err, "failed to generate AWS CloudFormation YAML")
 	}
 
-	if err := s.createStack(stackName, string(yaml)); err != nil {
+	if err := s.createStack(stackName, iam.ProcessPolicyDocument(string(yaml))); err != nil {
 		if code, _ := awserrors.Code(errors.Cause(err)); code == "AlreadyExistsException" {
 			klog.Infof("AWS Cloudformation stack %q already exists, updating", stackName)
 			updateErr := s.updateStack(stackName, string(yaml))

pkg/cloud/aws/services/iam/types.go

@@ -19,6 +19,7 @@ package iam
 import (
 	"encoding/json"
 	"fmt"
+	"strings"
 )
 
 const (
@@ -63,7 +64,13 @@ type StatementEntry struct {
 	Effect       string     `json:"Effect"`
 	Action       Actions    `json:"Action"`
 	Resource     Resources  `json:",omitempty"`
-	Condition    Conditions `json:",omitempty"`
+
+	// Condition is currently called IAMConditions to pass through
+	// GoFormation's template processing without being replaced
+	// with an intrinsic function. If you use a Condition statement,
+	// run the resultant stringified template through ProcessPolicyDocument
+	// to change back IAMCondition to Condition.
+	Condition Conditions `json:"IAMConditions,omitempty"`
 }
 
 // Statements is the list of StatementEntries
@@ -82,22 +89,26 @@ type Resources []string
 type PrincipalID []string
 
 // Conditions is the map of all conditions in the statement entry.
-type Conditions map[string]ConditionValues
-
-// ConditionValues are a list of condition values in a condition statement
-type ConditionValues []string
+type Conditions map[string]interface{}
 
 // JSON is the JSON output of the policy document
 func (p *PolicyDocument) JSON() (string, error) {
 	b, err := json.Marshal(&p)
 	if err != nil {
 		return "", err
 	}
-	return string(b), nil
+	return ProcessPolicyDocument(string(b)), nil
 }
 
 // NewManagedName creates an IAM acceptable name prefixed with this Cluster API
 // implementation's prefix.
 func NewManagedName(prefix string) string {
 	return fmt.Sprintf("%s.%s", prefix, IAMSuffix)
 }
+
+// ProcessPolicyDocument replaces IAMConditions in serialised StatementEntry
+// objects with Condition as per the AWS IAM policy schema as a work-around for
+// https://github.com/awslabs/goformation/issues/157
+func ProcessPolicyDocument(p string) string {
+	return strings.Replace(p, "IAMConditions", "Condition", 1)
+}