/kind feature
Describe the solution you'd like
Define separate IAM policies for the IAM roles used in the management and workload accounts in a multi-account CAPA deployment, following the principle of least privilege.
The existing IAM setup assumes a single AWS account, where the CloudFormation stack creates the IAM roles and attaches the policies required by CAPA. In a multi-account setup, the IAM role in the management account and the IAM role in the workload account have different responsibilities and therefore should not have the same policies.
The goal is to:
- Identify the AWS operations each IAM role needs to perform.
- Determine the minimum permissions required by each role.
- Define separate IAM policies for the management account role and the workload account role.
- Attach to each role only the policies required for its responsibilities.
- Avoid granting either role permissions that are only needed by the role in the other account.
- Consider extending the existing IAM/CloudFormation tooling to create the appropriate roles and policies for each account.
This would bring the multi-account IAM setup in line with the principle of least privilege while making the required IAM configuration reproducible and easier to maintain.
Anything else you would like to add:
Followup from #2105 #6188
Environment:
- Cluster-api-provider-aws version:
- Kubernetes version: (use
kubectl version):
- OS (e.g. from
/etc/os-release):
/kind feature
Describe the solution you'd like
Define separate IAM policies for the IAM roles used in the management and workload accounts in a multi-account CAPA deployment, following the principle of least privilege.
The existing IAM setup assumes a single AWS account, where the CloudFormation stack creates the IAM roles and attaches the policies required by CAPA. In a multi-account setup, the IAM role in the management account and the IAM role in the workload account have different responsibilities and therefore should not have the same policies.
The goal is to:
This would bring the multi-account IAM setup in line with the principle of least privilege while making the required IAM configuration reproducible and easier to maintain.
Anything else you would like to add:
Followup from #2105 #6188
Environment:
kubectl version):/etc/os-release):