Merge pull request #8548 from rifelpet/amazon-vpc-cni-1.6.0-iam

Update IAM permissions for amazon-vpc-cni-k8s 1.6.0
kubernetes · Feb 13, 2020 · 4ad5dd7 · 4ad5dd7
2 parents 91867ce + bf42bb0
commit 4ad5dd7
Showing 1 changed file with 6 additions and 5 deletions.
diff --git a/pkg/model/iam/iam_builder.go b/pkg/model/iam/iam_builder.go
@@ -871,16 +871,17 @@ func addAmazonVPCCNIPermissions(p *Policy, resource stringorslice.StringOrSlice,
 		&Statement{
 			Effect: StatementEffectAllow,
 			Action: stringorslice.Slice([]string{
-				"ec2:CreateNetworkInterface",
+				"ec2:AssignPrivateIpAddresses",
 				"ec2:AttachNetworkInterface",
+				"ec2:CreateNetworkInterface",
 				"ec2:DeleteNetworkInterface",
-				"ec2:DetachNetworkInterface",
-				"ec2:DescribeNetworkInterfaces",
 				"ec2:DescribeInstances",
+				"ec2:DescribeInstanceTypes",
+				"ec2:DescribeTags",
+				"ec2:DescribeNetworkInterfaces",
+				"ec2:DetachNetworkInterface",
 				"ec2:ModifyNetworkInterfaceAttribute",
-				"ec2:AssignPrivateIpAddresses",
 				"ec2:UnassignPrivateIpAddresses",
-				"tag:TagResources",
 			}),
 			Resource: resource,
 		},