Skip to content

Commit a8cd34b

Browse files
btatbtat
authored
Merge pull request #3102 from alexarnoldy/aarnoldy-eks-service-role-vpc
aarnoldy-eks-service-role-vpc
2 parents 1ac1490 + b505968 commit a8cd34b

File tree

2 files changed

+110
-100
lines changed
  • content/rancher
    • v2.5/en/cluster-provisioning/hosted-kubernetes-clusters/eks/permissions
    • v2.6/en/cluster-provisioning/hosted-kubernetes-clusters/eks/permissions

2 files changed

+110
-100
lines changed

‎content/rancher/v2.5/en/cluster-provisioning/hosted-kubernetes-clusters/eks/permissions/_index.md‎

Lines changed: 55 additions & 50 deletions
Original file line numberDiff line numberDiff line change
@@ -123,31 +123,6 @@ Resource targeting uses `*` as the ARN of many of the resources created cannot b
123123

124124
### Service Role Permissions
125125

126-
Rancher will create a service role with the following trust policy:
127-
128-
```json
129-
{
130-
"Version": "2012-10-17",
131-
"Statement": [
132-
{
133-
"Action": "sts:AssumeRole",
134-
"Principal": {
135-
"Service": "eks.amazonaws.com"
136-
},
137-
"Effect": "Allow",
138-
"Sid": ""
139-
}
140-
]
141-
}
142-
```
143-
144-
This role will also have two role policy attachments with the following policies ARNs:
145-
146-
```
147-
arn:aws:iam::aws:policy/AmazonEKSClusterPolicy
148-
arn:aws:iam::aws:policy/AmazonEKSServicePolicy
149-
```
150-
151126
Permissions required for Rancher to create service role on users behalf during the EKS cluster creation process.
152127

153128
```json
@@ -182,36 +157,66 @@ Permissions required for Rancher to create service role on users behalf during t
182157
}
183158
```
184159

160+
When an EKS cluster is created, Rancher will create a service role with the following trust policy:
161+
162+
```json
163+
{
164+
"Version": "2012-10-17",
165+
"Statement": [
166+
{
167+
"Action": "sts:AssumeRole",
168+
"Principal": {
169+
"Service": "eks.amazonaws.com"
170+
},
171+
"Effect": "Allow",
172+
"Sid": ""
173+
}
174+
]
175+
}
176+
```
177+
178+
This role will also have two role policy attachments with the following policies ARNs:
179+
180+
```
181+
arn:aws:iam::aws:policy/AmazonEKSClusterPolicy
182+
arn:aws:iam::aws:policy/AmazonEKSServicePolicy
183+
```
184+
185185
### VPC Permissions
186186

187187
Permissions required for Rancher to create VPC and associated resources.
188188

189189
```json
190190
{
191-
"Sid": "VPCPermissions",
192-
"Effect": "Allow",
193-
"Action": [
194-
"ec2:ReplaceRoute",
195-
"ec2:ModifyVpcAttribute",
196-
"ec2:ModifySubnetAttribute",
197-
"ec2:DisassociateRouteTable",
198-
"ec2:DetachInternetGateway",
199-
"ec2:DescribeVpcs",
200-
"ec2:DeleteVpc",
201-
"ec2:DeleteTags",
202-
"ec2:DeleteSubnet",
203-
"ec2:DeleteRouteTable",
204-
"ec2:DeleteRoute",
205-
"ec2:DeleteInternetGateway",
206-
"ec2:CreateVpc",
207-
"ec2:CreateSubnet",
208-
"ec2:CreateSecurityGroup",
209-
"ec2:CreateRouteTable",
210-
"ec2:CreateRoute",
211-
"ec2:CreateInternetGateway",
212-
"ec2:AttachInternetGateway",
213-
"ec2:AssociateRouteTable"
214-
],
215-
"Resource": "*"
191+
"Version": "2012-10-17",
192+
"Statement": [
193+
{
194+
"Sid": "VPCPermissions",
195+
"Effect": "Allow",
196+
"Action": [
197+
"ec2:ReplaceRoute",
198+
"ec2:ModifyVpcAttribute",
199+
"ec2:ModifySubnetAttribute",
200+
"ec2:DisassociateRouteTable",
201+
"ec2:DetachInternetGateway",
202+
"ec2:DescribeVpcs",
203+
"ec2:DeleteVpc",
204+
"ec2:DeleteTags",
205+
"ec2:DeleteSubnet",
206+
"ec2:DeleteRouteTable",
207+
"ec2:DeleteRoute",
208+
"ec2:DeleteInternetGateway",
209+
"ec2:CreateVpc",
210+
"ec2:CreateSubnet",
211+
"ec2:CreateSecurityGroup",
212+
"ec2:CreateRouteTable",
213+
"ec2:CreateRoute",
214+
"ec2:CreateInternetGateway",
215+
"ec2:AttachInternetGateway",
216+
"ec2:AssociateRouteTable"
217+
],
218+
"Resource": "*"
219+
}
220+
]
216221
}
217222
```

‎content/rancher/v2.6/en/cluster-provisioning/hosted-kubernetes-clusters/eks/permissions/_index.md‎

Lines changed: 55 additions & 50 deletions
Original file line numberDiff line numberDiff line change
@@ -123,31 +123,6 @@ Resource targeting uses `*` as the ARN of many of the resources created cannot b
123123

124124
### Service Role Permissions
125125

126-
Rancher will create a service role with the following trust policy:
127-
128-
```json
129-
{
130-
"Version": "2012-10-17",
131-
"Statement": [
132-
{
133-
"Action": "sts:AssumeRole",
134-
"Principal": {
135-
"Service": "eks.amazonaws.com"
136-
},
137-
"Effect": "Allow",
138-
"Sid": ""
139-
}
140-
]
141-
}
142-
```
143-
144-
This role will also have two role policy attachments with the following policies ARNs:
145-
146-
```
147-
arn:aws:iam::aws:policy/AmazonEKSClusterPolicy
148-
arn:aws:iam::aws:policy/AmazonEKSServicePolicy
149-
```
150-
151126
Permissions required for Rancher to create service role on users behalf during the EKS cluster creation process.
152127

153128
```json
@@ -182,36 +157,66 @@ Permissions required for Rancher to create service role on users behalf during t
182157
}
183158
```
184159

160+
When an EKS cluster is created, Rancher will create a service role with the following trust policy:
161+
162+
```json
163+
{
164+
"Version": "2012-10-17",
165+
"Statement": [
166+
{
167+
"Action": "sts:AssumeRole",
168+
"Principal": {
169+
"Service": "eks.amazonaws.com"
170+
},
171+
"Effect": "Allow",
172+
"Sid": ""
173+
}
174+
]
175+
}
176+
```
177+
178+
This role will also have two role policy attachments with the following policies ARNs:
179+
180+
```
181+
arn:aws:iam::aws:policy/AmazonEKSClusterPolicy
182+
arn:aws:iam::aws:policy/AmazonEKSServicePolicy
183+
```
184+
185185
### VPC Permissions
186186

187187
Permissions required for Rancher to create VPC and associated resources.
188188

189189
```json
190190
{
191-
"Sid": "VPCPermissions",
192-
"Effect": "Allow",
193-
"Action": [
194-
"ec2:ReplaceRoute",
195-
"ec2:ModifyVpcAttribute",
196-
"ec2:ModifySubnetAttribute",
197-
"ec2:DisassociateRouteTable",
198-
"ec2:DetachInternetGateway",
199-
"ec2:DescribeVpcs",
200-
"ec2:DeleteVpc",
201-
"ec2:DeleteTags",
202-
"ec2:DeleteSubnet",
203-
"ec2:DeleteRouteTable",
204-
"ec2:DeleteRoute",
205-
"ec2:DeleteInternetGateway",
206-
"ec2:CreateVpc",
207-
"ec2:CreateSubnet",
208-
"ec2:CreateSecurityGroup",
209-
"ec2:CreateRouteTable",
210-
"ec2:CreateRoute",
211-
"ec2:CreateInternetGateway",
212-
"ec2:AttachInternetGateway",
213-
"ec2:AssociateRouteTable"
214-
],
215-
"Resource": "*"
191+
"Version": "2012-10-17",
192+
"Statement": [
193+
{
194+
"Sid": "VPCPermissions",
195+
"Effect": "Allow",
196+
"Action": [
197+
"ec2:ReplaceRoute",
198+
"ec2:ModifyVpcAttribute",
199+
"ec2:ModifySubnetAttribute",
200+
"ec2:DisassociateRouteTable",
201+
"ec2:DetachInternetGateway",
202+
"ec2:DescribeVpcs",
203+
"ec2:DeleteVpc",
204+
"ec2:DeleteTags",
205+
"ec2:DeleteSubnet",
206+
"ec2:DeleteRouteTable",
207+
"ec2:DeleteRoute",
208+
"ec2:DeleteInternetGateway",
209+
"ec2:CreateVpc",
210+
"ec2:CreateSubnet",
211+
"ec2:CreateSecurityGroup",
212+
"ec2:CreateRouteTable",
213+
"ec2:CreateRoute",
214+
"ec2:CreateInternetGateway",
215+
"ec2:AttachInternetGateway",
216+
"ec2:AssociateRouteTable"
217+
],
218+
"Resource": "*"
219+
}
220+
]
216221
}
217222
```

0 commit comments

Comments
 (0)