Merge pull request #16414 from hakman/automated-cherry-pick-of-#16412…

…-upstream-release-1.29 Automated cherry pick of #16412: aws/cert-manager: Tighten IAM permissions for cert-manager
kubernetes · Mar 20, 2024 · 7c4faf7 · 7c4faf7
2 parents c2b7478 + 0b65811
commit 7c4faf7
Showing 1 changed file with 16 additions and 4 deletions.
diff --git a/pkg/model/components/addonmanifests/certmanager/iam.go b/pkg/model/components/addonmanifests/certmanager/iam.go
@@ -56,11 +56,23 @@ func addCertManagerPermissions(b *iam.PolicyBuilder, p *iam.Policy) {
 	}
 
 	p.Statement = append(p.Statement, &iam.Statement{
-		Effect: iam.StatementEffectAllow,
-		Action: stringorset.Of("route53:ChangeResourceRecordSets",
-			"route53:ListResourceRecordSets",
-		),
+		Effect:   iam.StatementEffectAllow,
+		Action:   stringorset.Of("route53:ListResourceRecordSets"),
+		Resource: stringorset.Set(zoneResources),
+	})
+
+	p.Statement = append(p.Statement, &iam.Statement{
+		Effect:   iam.StatementEffectAllow,
+		Action:   stringorset.Of("route53:ChangeResourceRecordSets"),
 		Resource: stringorset.Set(zoneResources),
+		Condition: iam.Condition{
+			"ForAllValues:StringLike": map[string]interface{}{
+				"route53:ChangeResourceRecordSetsNormalizedRecordNames": []string{"_acme-challenge.*"},
+			},
+			"ForAllValues:StringEquals": map[string]interface{}{
+				"route53:ChangeResourceRecordSetsRecordTypes": []string{"TXT"},
+			},
+		},
 	})
 
 	p.Statement = append(p.Statement, &iam.Statement{