🏁 Script executed:

#!/bin/bash
set -eu

printf '%s\n' '--- target file ---'
cat -n manifests/03_credentials_request_aws.yaml | sed -n '1,100p'

printf '%s\n' '--- related AWS credential requests and policy-generation references ---'
rg -n -C 3 'CopyVolumes|LockSnapshot|statementEntries|03_credentials_request_aws|AmazonEBSCSIDriverPolicy|ec2:' . \
  -g '*.yaml' -g '*.yml' -g '*.json' -g '*.go' -g '*.md' \
  | sed -n '1,260p'

Repository: openshift/cluster-storage-operator

Length of output: 23009

🌐 Web query:

AWS AmazonEBSCSIDriverPolicy ec2:CopyVolumes ec2:LockSnapshot resource conditions

💡 Result:

The Amazon EBS CSI driver managed policies (AmazonEBSCSIDriverPolicy and AmazonEBSCSIDriverPolicyV2) utilize specific resource conditions to scope permissions for EBS snapshot management, including locking and deletion [1][2]. 1. Snapshot Lock and Delete Conditions: In the AmazonEBSCSIDriverPolicyV2, the ec2:LockSnapshot and ec2:DeleteSnapshot actions are allowed on the resource arn:aws:ec2:::snapshot/*, but scoped using the following condition [1]: - StringEquals: { ec2:ResourceTag/ebs.csi.aws.com/cluster: true } This ensures the CSI driver can only lock or delete snapshots that are explicitly associated with its managed Kubernetes cluster via this tag [3]. The older AmazonEBSCSIDriverPolicy includes similar conditions using both ec2:ResourceTag/ebs.csi.aws.com/cluster and ec2:ResourceTag/CSIVolumeSnapshotName [2]. 2. Regarding ec2:CopySnapshot: The ec2:CopySnapshot action is not explicitly listed in the standard statements for locking or deleting snapshots within the current AmazonEBSCSIDriverPolicyV2 [1]. While ec2:CreateTags includes a condition for ec2:CreateAction (which references CopyVolumes), the base policy is designed to manage lifecycle operations like creating, attaching, and deleting volumes and snapshots [1][3]. If your workflow requires copying snapshots, it is generally considered an administrative or external orchestration task rather than a core driver operation, and typically requires separate IAM permissions [4][5]. 3. General Resource Condition Guidance: When defining custom policies for these actions, you can further restrict access using condition keys. For ec2:LockSnapshot, you can use keys like ec2:SnapshotLockDuration (to restrict duration) and ec2:CoolOffPeriod (to enforce mandatory cooling-off periods for compliance-mode locks) [6]. As a best practice, always apply the tag-based resource conditions demonstrated in the managed policies to prevent the driver from accidentally affecting snapshots outside the scope of your Kubernetes clusters [3].

Citations:

• 1: https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonEBSCSIDriverPolicyV2.html
• 2: https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonEBSCSIDriverPolicy.html
• 3: https://github.com/kubernetes-sigs/aws-ebs-csi-driver/blob/master/docs/install.md
• 4: https://docs.aws.amazon.com/service-authorization/latest/reference/list_ec2.html
• 5: https://docs.aws.amazon.com/ebs/latest/userguide/ebs-copy-snapshot.html
• 6: https://docs.aws.amazon.com/ebs/latest/userguide/snapshot-lock-iam.html

🌐 Web query:

Cloud Credential Operator AWSProviderSpec statementEntries policyCondition generated IAM policy resource fields

💡 Result:

In the OpenShift Cloud Credential Operator (CCO), the AWSProviderSpec is used within a CredentialsRequest custom resource to define the specific IAM permissions required by an OpenShift component [1][2][3]. The statementEntries field is an array that maps directly to the AWS IAM Policy Statement structure [4][5][6]. Each entry in this list defines a specific set of permissions and includes the following key fields: Effect: Defines whether the statement allows or denies access (e.g., "Allow") [7][8][9]. Action: A list of strings specifying the AWS API actions allowed or denied (e.g., ["s3:CreateBucket"]) [8][2][9]. Resource: Specifies the AWS resources to which the action applies (e.g., "*") [7][8][9]. PolicyCondition: An optional field corresponding to the AWS IAM "Condition" element [4][5][9]. This allows for fine-grained control, such as restricting access based on specific conditions like StringEquals or DateLessThan [9]. When the CCO processes these entries, it serializes them into a standard AWS IAM Policy Document format [4][5]. It is critical to use the omitempty tag for the PolicyCondition field during serialization; otherwise, the operator may send an invalid JSON structure to the AWS API when no conditions are defined [10][5][6]. The operator automatically handles the conversion of these Kubernetes-defined fields into the JSON format required by the AWS IAM API [4][5].

Citations:

• 1: https://docs.redhat.com/ko/documentation/openshift_container_platform/4.18/html/authentication_and_authorization/managing-cloud-provider-credentials
• 2: https://github.com/openshift/cloud-credential-operator
• 3: https://docs.redhat.com/ko/documentation/openshift_container_platform/4.16/html/postinstallation_configuration/changing-cloud-credentials-configuration
• 4: https://github.com/openshift/cloud-credential-operator/blob/release-4.5/pkg/aws/actuator/actuator.go
• 5: https://github.com/openshift/cloud-credential-operator/blob/master/pkg/cmd/provisioning/aws/create-iam-roles.go
• 6: https://github.com/openshift/cloud-credential-operator/blob/master/pkg/aws/actuator/actuator.go
• 7: https://docs.redhat.com/ko/documentation/openshift_container_platform/4.7/html/installing/manually-create-iam_manually-creating-iam-aws
• 8: https://docs.redhat.com/ko/documentation/openshift_container_platform/4.15/html/installing_on_aws/installing-aws-manual-modes_installing-aws-customizations
• 9: https://bugzilla.redhat.com/show_bug.cgi?id=1871954
• 10: https://pkg.go.dev/github.com/openshift/cloud-credential-operator/pkg/aws/actuator

🏁 Script executed:

#!/bin/bash
set -eu

python3 - <<'PY'
import json
import urllib.request

urls = {
    "policy": "https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonEBSCSIDriverPolicy.html",
    "policy_v2": "https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonEBSCSIDriverPolicyV2.html",
    "ec2_actions": "https://raw.githubusercontent.com/awsdocs/aws-ec2-user-guide/main/doc_source/ebs-using-volumes.md",
}

for name, url in urls.items():
    print(f"--- {name}: {url} ---")
    try:
        with urllib.request.urlopen(url, timeout=20) as response:
            text = response.read().decode("utf-8", "replace")
        for term in ("CopyVolumes", "CopySnapshot", "LockSnapshot", "DeleteSnapshot",
                     "ebs.csi.aws.com/cluster", "CSIVolumeSnapshotName"):
            print(f"{term}: {text.find(term)}")
        print(text[:5000])
    except Exception as exc:
        print(f"ERROR: {exc}")
PY

Repository: openshift/cluster-storage-operator

Length of output: 942

🏁 Script executed:

#!/bin/bash
set -eu

python3 - <<'PY'
import urllib.request

urls = {
    "policy": "https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonEBSCSIDriverPolicy.html",
    "policy_v2": "https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonEBSCSIDriverPolicyV2.html",
}

for name, url in urls.items():
    print(f"--- {name} ---")
    try:
        with urllib.request.urlopen(url, timeout=20) as response:
            text = response.read().decode("utf-8", "replace")
        for term in (
            "CopyVolumes", "CopySnapshot", "LockSnapshot", "DeleteSnapshot",
            "ebs.csi.aws.com/cluster", "CSIVolumeSnapshotName",
        ):
            print(f"{term}: {text.find(term)}")
        print(text[:12000])
    except Exception as exc:
        print(f"ERROR: {exc}")
PY

Repository: openshift/cluster-storage-operator

Length of output: 489

🏁 Script executed:

#!/bin/bash
set -eu

for url in \
  'https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonEBSCSIDriverPolicy.html' \
  'https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonEBSCSIDriverPolicyV2.html'
do
  echo "--- $url ---"
  curl -ksS "$url" |
    sed 's/<[^>]*>/ /g' |
    tr -s '[:space:]' ' ' |
    grep -oE '.{0,500}(CopyVolumes|CopySnapshot|LockSnapshot|DeleteSnapshot|ebs\.csi\.aws\.com/cluster|CSIVolumeSnapshotName).{0,900}' || true
done

echo '--- CCO AWS policy serialization ---'
for url in \
  'https://raw.githubusercontent.com/openshift/cloud-credential-operator/master/pkg/aws/actuator/actuator.go' \
  'https://raw.githubusercontent.com/openshift/cloud-credential-operator/master/pkg/apis/cloudcredential/v1/aws.go'
do
  echo "--- $url ---"
  curl -ksS "$url" |
    grep -n -C 8 -E 'statementEntries|PolicyCondition|Resource|Statement' |
    sed -n '1,260p' || true
done

Repository: openshift/cluster-storage-operator

Length of output: 18870