Update the cross-account example with working policy

[olemarkus]

No description provided.

[hakman]

/lgtm

[hakman]

/retest

[zetaab]

We are using policy like this

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowRootAndHomeListingOfCompanyBucket",
            "Effect": "Allow",
            "Action": "s3:ListBucket",
            "Resource": "arn:aws:s3:::<state bucket>",
            "Condition": {
                "StringEquals": {
                    "s3:delimiter": "/",
                    "s3:prefix": ""
                }
            }
        },
        {
            "Sid": "AllowListingOfUserFolder",
            "Effect": "Allow",
            "Action": "s3:ListBucket",
            "Resource": "arn:aws:s3:::<state bucket>",
            "Condition": {
                "StringLike": {
                    "s3:prefix": "${aws:username}/*"
                }
            }
        },
        {
            "Sid": "AllowAllS3ActionsInUserFolder",
            "Effect": "Allow",
            "Action": "s3:*",
            "Resource": "arn:aws:s3:::<state bucket>/${aws:username}/*"
        }
    ]
}

So what we do:

1. create new IAM group and attach that policy there (this needs to be done only once)
2. When we need new cluster:
   • create new IAM user which matches to clustername, example: mycluster.k8s.local
   • attach IAM group to user
   • use IAM user credentials to authenticate against S3 bucket (env vars S3_ACCESS_KEY_ID and S3_SECRET_ACCESS_KEY needs to be defined)

After that each cluster has access to only own state store folder. It makes it possible to also have "root" account which has access to all clusters if needed for ops purposes, but note that all modifying kops commands should be executed using those IAM user credentials.

[olemarkus]

This is in addition to the content in the PR, right? So the group is done once per account, and the IAM user is once per cluser? You share this user among everyone that can operate that particular cluster?

[johngmyers]

/lgtm

[rifelpet]

/approve

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: olemarkus, rifelpet

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [rifelpet]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[rifelpet]

/retest