Versions Compared

Version Old Version 60 New Version Current
Changes made by

Bhargav Ravuri

Bhargav Ravuri

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

IAM Permissions
Expand
titleIAM Permissions for the AWS Account - Standalone Flow

When working with standalone flow i.e., deploying everything from scratch using the create-standalone command, use the following IAM policy.

Please add your AWS account ID and cluster name to the policy below.

Code Block
languagejson
{
	"Version": "2012-10-17",
	"Statement": [
		{
			"Effect": "Allow",
			"Action": [
				"autoscalingiam:CompleteLifecycleActionPassRole",
				"autoscaling:CreateAutoScalingGroup"],
				"Resource"autoscaling:DeleteAutoScalingGroup", [
				"autoscaling:EnableMetricsCollectionarn:aws:iam::<account-id>:role/<cluster-name>*",
				"autoscaling:PutNotificationConfiguration",
				"autoscaling:UpdateAutoScalingGrouparn:aws:iam::<account-id>:role/terraform-*"
			],
			"Resource": "*"
		},
		{
			"Effect": "Allow",
			"Action": [
				"ec2autoscaling:AllocateAddressCompleteLifecycleAction",
				"ec2autoscaling:AssignPrivateIpAddressesCreateAutoScalingGroup",
				"ec2autoscaling:AssociateRouteTableDeleteAutoScalingGroup",
				"ec2autoscaling:AttachInternetGatewayEnableMetricsCollection",
				"ec2autoscaling:AttachNetworkInterfacePutNotificationConfiguration",
				"ec2autoscaling:AuthorizeSecurityGroupEgressUpdateAutoScalingGroup"
			],
				"Resource"ec2:AuthorizeSecurityGroupIngress" "*"
		},
		{
			"Effect"ec2:CreateFleet "Allow",
				"Action"ec2:CreateInternetGateway", [
				"ec2:CreateLaunchTemplateAllocateAddress",
				"ec2:CreateLaunchTemplateVersionAssignPrivateIpAddresses",
				"ec2:CreateNatGatewayAssociateRouteTable",
				"ec2:CreateNetworkAclEntryAttachInternetGateway",
				"ec2:CreateNetworkInterfaceAttachNetworkInterface",
				"ec2:CreateNetworkInterfacePermissionAuthorizeSecurityGroupEgress",
				"ec2:CreateRouteAuthorizeSecurityGroupIngress",
				"ec2:CreateRouteTableCreateFleet",
				"ec2:CreateSecurityGroupCreateInternetGateway",
				"ec2:CreateSubnetCreateLaunchTemplate",
				"ec2:CreateTagsCreateLaunchTemplateVersion",
				"ec2:CreateVpcCreateNatGateway",
				"ec2:DeleteInternetGatewayCreateNetworkAclEntry",
				"ec2:DeleteLaunchTemplateCreateNetworkInterface",
				"ec2:DeleteNatGatewayCreateNetworkInterfacePermission",
				"ec2:DeleteNetworkAclEntryCreateRoute",
				"ec2:DeleteNetworkInterfaceCreateRouteTable",
				"ec2:DeleteRouteCreateSecurityGroup",
				"ec2:DeleteRouteTableCreateSubnet",
				"ec2:DeleteSecurityGroupCreateTags",
				"ec2:DeleteSubnetCreateVpc",
				"ec2:DeleteTagsDeleteInternetGateway",
				"ec2:DeleteVpcDeleteLaunchTemplate",
				"ec2:DescribeAddressesDeleteNatGateway",
				"ec2:DescribeAddressesAttributeDeleteNetworkAclEntry",
				"ec2:DescribeAvailabilityZonesDeleteNetworkInterface",
				"ec2:DescribeDhcpOptionsDeleteRoute",
				"ec2:DescribeImagesDeleteRouteTable",
				"ec2:DescribeInstanceAttributeDeleteSecurityGroup",
				"ec2:DescribeInstancesDeleteSubnet",
				"ec2:DescribeInstanceTypesDeleteTags",
				"ec2:DescribeInternetGatewaysDeleteVpc",
				"ec2:DescribeLaunchTemplatesDescribeAddresses",
				"ec2:DescribeLaunchTemplateVersionsDescribeAddressesAttribute",
				"ec2:DescribeNatGatewaysDescribeAvailabilityZones",
				"ec2:DescribeNetworkAclsDescribeDhcpOptions",
				"ec2:DescribeNetworkInterfacesDescribeImages",
				"ec2:DescribeRouteTablesDescribeInstanceAttribute",
				"ec2:DescribeSecurityGroupRulesDescribeInstances",
				"ec2:DescribeSecurityGroupsDescribeInstanceTypes",
				"ec2:DescribeSnapshotsDescribeInternetGateways",
				"ec2:DescribeSubnetsDescribeKeyPairs",
				"ec2:DescribeTagsDescribeLaunchTemplates",
				"ec2:DescribeVolumesDescribeLaunchTemplateVersions",
				"ec2:DescribeVpcAttributeDescribeNatGateways",
				"ec2:DescribeVpcsDescribeNetworkAcls",
				"ec2:DetachInternetGatewayDescribeNetworkInterfaces",
				"ec2:DetachNetworkInterfaceDescribeRouteTables",
				"ec2:DisassociateAddressDescribeSecurityGroupRules",
				"ec2:DisassociateRouteTableDescribeSecurityGroups",
				"ec2:ModifyInstanceAttributeDescribeSnapshots",
				"ec2:ModifyLaunchTemplateDescribeSubnets",
				"ec2:ModifyNetworkInterfaceAttributeDescribeTags",
				"ec2:ModifySubnetAttributeDescribeVolumes",
				"ec2:ModifyVpcAttributeDescribeVpcAttribute",
				"ec2:ReleaseAddressDescribeVpcs",
				"ec2:RevokeSecurityGroupEgressDetachInternetGateway",
				"ec2:RevokeSecurityGroupIngressDetachNetworkInterface",
				"ec2:RunInstancesDisassociateAddress",
				"ec2:TerminateInstancesDisassociateRouteTable",
			],
			"Resource"ec2: "*"
		}ModifyInstanceAttribute",
		{
			"Effect": "Allowec2:ModifyLaunchTemplate",
				"Actionec2:ModifyNetworkInterfaceAttribute":,
[
				"eksec2:AssociateAccessPolicyModifySubnetAttribute",
				"eksec2:CreateAccessEntryModifyVpcAttribute",
				"eksec2:CreateAddonReleaseAddress",
				"eksec2:CreateClusterRevokeSecurityGroupEgress",
				"eksec2:CreateNodegroupRevokeSecurityGroupIngress",
				"eksec2:DeleteAccessEntryRunInstances",
				"eksec2:DeleteAddonTerminateInstances"
			],
				"Resource"eks:DeleteCluster" "*"
		},
		{
			"eks:DeleteNodegroup",
Effect": "Allow",
			"Action": [
				"eks:DescribeAccessEntryAssociateAccessPolicy",
				"eks:DescribeAddonCreateAccessEntry",
				"eks:DescribeAddonVersionsCreateAddon",
				"eks:DescribeClusterCreateCluster",
				"eks:DescribeNodegroupCreateNodegroup",
				"eks:DisassociateAccessPolicyDeleteAccessEntry",
				"eks:ListAssociatedAccessPoliciesDeleteAddon",
				"eks:ListNodegroupsDeleteCluster",
				"eks:TagResourceDeleteNodegroup",
			]	"eks:DescribeAccessEntry",
				"Resource"eks:DescribeAddon",
"*"				"eks:DescribeAddonVersions",
		}		"eks:DescribeCluster",
		{		"eks:DescribeNodegroup",
				"Effect"eks: DisassociateAccessPolicy"Allow",
				"Action": [eks:ListAssociatedAccessPolicies",
				"eventseks:PutRuleListNodegroups",
				"eventseks:PutTargetsTagResource"
			],
			"Resource": "*"
		},
		{
			"Effect": "Allow",
			"Action": [
				"iamevents:AddRoleToInstanceProfilePutRule",
				"iamevents:AttachRolePolicyPutTargets",
				"iam:CreateInstanceProfile"],
				"Resource"iam:CreateOpenIDConnectProvider "*",
		},
		{
			"Effect": "Allow",
			"Action": [
				"iam:AddRoleToInstanceProfile",
				"iam:AttachRolePolicy",
				"iam:CreateInstanceProfile",
				"iam:CreateOpenIDConnectProvider",
				"iam:CreatePolicy",
				"iam:CreateRole",
				"iam:DeleteInstanceProfile",
				"iam:DeleteOpenIDConnectProvider",
				"iam:DeletePolicy",
				"iam:DeleteRole",
				"iam:DeleteRolePolicy",
				"iam:DetachRolePolicy",
				"iam:GetInstanceProfile",
				"iam:GetOpenIDConnectProvider",
				"iam:GetPolicy",
				"iam:GetPolicyVersion",
				"iam:GetRole",
				"iam:GetRolePolicy",
				"iam:ListAttachedRolePolicies",
				"iam:ListInstanceProfilesForRole",
				"iam:ListPolicyVersions",
				"iam:ListRolePolicies",
				"iam:PutRolePolicy",
				"iam:RemoveRoleFromInstanceProfile",
				"iam:TagInstanceProfile",
				"iam:TagOpenIDConnectProvider",
				"iam:TagRole"TagPolicy",
				"iam:TagRole"
			],
			"Resource": "*"
		},
		{
			"Effect": "Allow",
			"Action": [
				"iamkms:PassRoleCreateAlias",
			]	"kms:CreateGrant",
				"Resourcekms:CreateKey":,
[
				"arn:aws:iam::<account-id>:role/<cluster-name>*kms:DeleteAlias",
				"arn:aws:iam::<account-id>:role/terraform-*"kms:DescribeKey",
			]
		}	"kms:EnableKeyRotation",
		{
			"Effect": "Allow",
			"Action": [
				"kms:CreateAlias		"kms:GetKeyPolicy",
				"kms:CreateGrantGetKeyRotationStatus",
				"kms:CreateKeyListAliases",
				"kms:DeleteAliasListResourceTags",
				"kms:EnableKeyRotation",
				"kms:ListAliasesPutKeyPolicy",
				"kms:RetireGrant",
				"kms:ScheduleKeyDeletion",
				"kms:TagResource"
			],
			"Resource": "*"
		},
		{
			"Effect": "Allow",
			"Action": [
				"logs:CreateLogGroup",
				"logs:CreateLogStream",
				"logs:DeleteLogGroup",
				"logs:DescribeLogGroups",
				"logs:ListTagsForResource",
				"logs:PutRetentionPolicy",
				"logs:TagResource"
			],
			"Resource": "*"
		},
		{
			"Effect": "Allow",
			"Action": [
				"aws-marketplace:ListEntities"
			],
			"Resource": "*"
		},
		{
			"Effect": "Allow",
			"Action": [
				"ssms3:RegisterManagedInstanceGetObject",
				"ssms3:UpdateInstanceInformationListBucket"
			],
			"Resource": "*"
		},
	]
}
Expand
title
	{
			"Effect": "Allow",
			"Action": [
				"ssm:RegisterManagedInstance",
				"ssm:UpdateInstanceInformation"
			],
			"Resource": "*"
		}
	]
}
Expand
titleIAM Permissions for the AWS Account - Using an Existing Cluster

When working with existing EKS clusters, use the following IAM policy.

Please add your AWS account ID and cluster name to the policy below.

Code Block
languagejson
{
    	"Version": "2012-10-17",
    	"Statement": [
        {
            		{
			"Effect": "Allow",
            			"Action": [
                "aws-marketplace:ListEntities				"iam:PassRole"
			],
			"Resource": "*"[
		},
		{
			""arn:aws:iam::<account-id>:role/<cluster-name>*",
				"arn:aws:iam::<account-id>:role/terraform-*"
			]
		},
		{
			"Effect": "Allow",
			"Action": [
				"aws-marketplace:ListEntities"
			],
			"Resource": "*"
		},
		{
			"Effect": "Allow",
			"Action": [
      				"ec2:AuthorizeSecurityGroupEgress",
				"ec2:ModifyInstanceAttributeAuthorizeSecurityGroupIngress",
                				"ec2:AuthorizeSecurityGroupEgressCreateSecurityGroup",
                				"ec2:CreateTags",
				"ec2:AuthorizeSecurityGroupIngressDeleteSecurityGroup",
                				"ec2:CreateSecurityGroupDescribeDhcpOptions",
                				"ec2:CreateTagsDescribeImages",
                				"ec2:DescribeInstanceAttribute",
				"ec2:DeleteSecurityGroupDescribeInstances",
                				"ec2:DescribeDhcpOptionsDescribeInstanceTypes",
                				"ec2:DescribeImagesDescribeInternetGateways",
                "ec2:DescribeInstanceAttribute",
                "ec2:DescribeInstances",
                "ec2:DescribeInstanceTypes",
                "ec2:DescribeInternetGateways",
                "ec2:DescribeNatGateways",
                "ec2:DescribeNetworkInterfaces",
                "ec2:DescribeRouteTables",
                "ec2:DescribeSecurityGroups",
                "ec2:DescribeSnapshots",
                "ec2:DescribeSubnets",
                "ec2:DescribeTags",
                "ec2:DescribeVolumes",
                "ec2:DescribeVpcAttribute",
                "ec2:DescribeVpcs",
                "ec2:RevokeSecurityGroupEgress",
                "ec2:RunInstances",
                "ec2:TerminateInstances"
			],
			"Resource": "*"
		},
		{
			"Effect": "Allow",
			"Action": [
                "eks:DescribeCluster",
                "eks:DescribeNodegroup",
                "eks:ListNodegroups"
			],
			"Resource": "*"
		},
		{
			"Effect": "Allow",
			"Action": [
                "iam:AddRoleToInstanceProfile",
                "iam:AttachRolePolicy",
                "iam:CreateInstanceProfile",
                "iam:CreateRole",
                "iam:DeleteInstanceProfile",
                "iam:DeleteRole",
                "iam:DeleteRolePolicy",
                "iam:DetachRolePolicy",
                "iam:GetInstanceProfile",
                "iam:GetPolicy",
                "iam:GetPolicyVersion",
                "iam:GetRole",
                "iam:GetRolePolicy",
                "iam:ListAttachedRolePolicies",
                "iam:ListInstanceProfilesForRole",
                "iam:ListRolePolicies",
                "iam:PutRolePolicy",
                "iam:RemoveRoleFromInstanceProfile",
                "iam:TagInstanceProfile",
                				"ec2:DescribeNatGateways",
				"ec2:DescribeNetworkInterfaces",
				"ec2:DescribeRouteTables",
				"ec2:DescribeSecurityGroups",
				"ec2:DescribeSnapshots",
				"ec2:DescribeSubnets",
				"ec2:DescribeTags",
				"ec2:DescribeVolumes",
				"ec2:DescribeVpcAttribute",
				"ec2:DescribeVpcs",
				"ec2:ModifyInstanceAttribute",
				"ec2:RevokeSecurityGroupEgress",
				"ec2:RunInstances",
				"ec2:TerminateInstances"
			],
			"Resource": "*"
		},
		{
			"Effect": "Allow",
			"Action": [
				"eks:DescribeCluster",
				"eks:DescribeNodegroup",
				"eks:ListNodegroups"
			],
			"Resource": "*"
		},
		{
			"Effect": "Allow",
			"Action": [
				"iam:AddRoleToInstanceProfile",
				"iam:AttachRolePolicy",
				"iam:CreateInstanceProfile",
				"iam:CreateRole",
				"iam:DeleteInstanceProfile",
				"iam:DeleteRole",
				"iam:DeleteRolePolicy",
				"iam:DetachRolePolicy",
				"iam:GetInstanceProfile",
				"iam:GetPolicy",
				"iam:GetPolicyVersion",
				"iam:GetRole",
				"iam:GetRolePolicy",
				"iam:ListAttachedRolePolicies",
				"iam:ListInstanceProfilesForRole",
				"iam:ListRolePolicies",
				"iam:PutRolePolicy",
				"iam:RemoveRoleFromInstanceProfile",
				"iam:TagInstanceProfile",
				"iam:TagRole"
			],
			"Resource": "*"
		},
		{
			"Effect": "Allow",
			"Action": [
				"iams3:PassRoleGetObject",
			],
			"Resources3:ListBucket":
[
				"arn:aws:iam::<account-id>:role/<cluster-name>*"],
				"Resource"arn:aws:iam::<account-id>:role/terraform-: "*"
			]}
		}
    ]
}

...