feat: Align EBS CSI driver poicy with upstream repo

Author: bryantbiggs

.pre-commit-config.yaml

@@ -1,6 +1,6 @@
 repos:
   - repo: https://github.com/antonbabenko/pre-commit-terraform
-    rev: v1.99.1
+    rev: v1.99.4
     hooks:
       - id: terraform_fmt
       - id: terraform_wrapper_module_for_each

modules/iam-role-for-service-accounts-eks/policies.tf

@@ -188,34 +188,66 @@ data "aws_iam_policy_document" "ebs_csi" {
 
   statement {
     actions = [
-      "ec2:CreateSnapshot",
-      "ec2:AttachVolume",
-      "ec2:DetachVolume",
-      "ec2:ModifyVolume",
       "ec2:DescribeAvailabilityZones",
       "ec2:DescribeInstances",
       "ec2:DescribeSnapshots",
       "ec2:DescribeTags",
       "ec2:DescribeVolumes",
       "ec2:DescribeVolumesModifications",
-      "ec2:EnableFastSnapshotRestores"
     ]
 
     resources = ["*"]
   }
 
   statement {
-    actions = ["ec2:CreateTags"]
+    actions = [
+      "ec2:CreateSnapshot",
+      "ec2:ModifyVolume",
+    ]
+
+    resources = ["arn:${local.partition}:ec2:*:*:volume/*"]
+  }
+
+  statement {
+    actions = [
+      "ec2:AttachVolume",
+      "ec2:DetachVolume",
+    ]
+
+    resources = [
+      "arn:${local.partition}:ec2:*:*:volume/*",
+      "arn:${local.partition}:ec2:*:*:instance/*",
+    ]
+  }
+
+  statement {
+    actions = [
+      "ec2:CreateVolume",
+      "ec2:EnableFastSnapshotRestores",
+    ]
 
+    resources = ["arn:${local.partition}:ec2:*:*:snapshot/*"]
+  }
+
+  statement {
+    actions = ["ec2:CreateTags"]
     resources = [
       "arn:${local.partition}:ec2:*:*:volume/*",
       "arn:${local.partition}:ec2:*:*:snapshot/*",
     ]
+
+    condition {
+      test     = "StringEquals"
+      variable = "ec2:CreateAction"
+      values = [
+        "CreateVolume",
+        "CreateSnapshot",
+      ]
+    }
   }
 
   statement {
     actions = ["ec2:DeleteTags"]
-
     resources = [
       "arn:${local.partition}:ec2:*:*:volume/*",
       "arn:${local.partition}:ec2:*:*:snapshot/*",
@@ -229,9 +261,7 @@ data "aws_iam_policy_document" "ebs_csi" {
     condition {
       test     = "StringLike"
       variable = "aws:RequestTag/ebs.csi.aws.com/cluster"
-      values = [
-        true
-      ]
+      values   = ["true"]
     }
   }
 
@@ -247,84 +277,79 @@ data "aws_iam_policy_document" "ebs_csi" {
   }
 
   statement {
-    actions   = ["ec2:CreateVolume"]
-    resources = ["*"]
+    actions   = ["ec2:DeleteVolume"]
+    resources = ["arn:${local.partition}:ec2:*:*:volume/*"]
 
     condition {
       test     = "StringLike"
-      variable = "aws:RequestTag/kubernetes.io/cluster/*"
-      values   = ["owned"]
+      variable = "aws:ResourceTag/ebs.csi.aws.com/cluster"
+      values   = ["true"]
     }
   }
 
-  statement {
-    actions   = ["ec2:CreateVolume"]
-    resources = ["arn:${local.partition}:ec2:*:*:snapshot/*"]
-  }
-
   statement {
     actions   = ["ec2:DeleteVolume"]
-    resources = ["*"]
+    resources = ["arn:${local.partition}:ec2:*:*:volume/*"]
 
     condition {
       test     = "StringLike"
-      variable = "ec2:ResourceTag/ebs.csi.aws.com/cluster"
-      values   = [true]
+      variable = "aws:ResourceTag/CSIVolumeName"
+      values   = ["*"]
     }
   }
 
   statement {
     actions   = ["ec2:DeleteVolume"]
-    resources = ["*"]
+    resources = ["arn:${local.partition}:ec2:*:*:volume/*"]
 
     condition {
       test     = "StringLike"
-      variable = "ec2:ResourceTag/CSIVolumeName"
+      variable = "ec2:ResourceTag/kubernetes.io/created-for/pvc/name"
       values   = ["*"]
     }
   }
 
   statement {
-    actions   = ["ec2:DeleteVolume"]
-    resources = ["*"]
+    actions   = ["ec2:CreateSnapshot"]
+    resources = ["arn:${local.partition}:ec2:*:*:snapshot/*"]
 
     condition {
       test     = "StringLike"
-      variable = "ec2:ResourceTag/kubernetes.io/cluster/*"
-      values   = ["owned"]
+      variable = "aws:RequestTag/CSIVolumeSnapshotName"
+      values   = ["*"]
     }
   }
 
   statement {
-    actions   = ["ec2:DeleteVolume"]
-    resources = ["*"]
+    actions   = ["ec2:CreateSnapshot"]
+    resources = ["arn:${local.partition}:ec2:*:*:snapshot/*"]
 
     condition {
       test     = "StringLike"
-      variable = "ec2:ResourceTag/kubernetes.io/created-for/pvc/name"
-      values   = ["*"]
+      variable = "aws:RequestTag/ebs.csi.aws.com/cluster"
+      values   = ["true"]
     }
   }
 
   statement {
     actions   = ["ec2:DeleteSnapshot"]
-    resources = ["*"]
+    resources = ["arn:${local.partition}:ec2:*:*:snapshot/*"]
 
     condition {
       test     = "StringLike"
-      variable = "ec2:ResourceTag/CSIVolumeSnapshotName"
+      variable = "aws:ResourceTag/CSIVolumeSnapshotName"
       values   = ["*"]
     }
   }
 
   statement {
     actions   = ["ec2:DeleteSnapshot"]
-    resources = ["*"]
+    resources = ["arn:${local.partition}:ec2:*:*:snapshot/*"]
 
     condition {
       test     = "StringLike"
-      variable = "ec2:ResourceTag/ebs.csi.aws.com/cluster"
-      values   = [true]
+      variable = "aws:ResourceTag/ebs.csi.aws.com/cluster"
+      values   = ["true"]
     }
   }