Skip to content

Commit c6b5c6a

Browse files
k8s-ci-robotk8s-ci-robot
authored
Merge pull request #4032 from orsenthil/added_regional_tests
Added ISO Policy for iso-e and iso-f in example docs, and updated integration test script based on *testing already done*
2 parents 06e57df + 7e0269a commit c6b5c6a

File tree

6 files changed

+1618
-1089
lines changed

6 files changed

+1618
-1089
lines changed

‎docs/install/iam_policy_isoe.json

+242
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,242 @@
1+
{
2+
"Version": "2012-10-17",
3+
"Statement": [
4+
{
5+
"Effect": "Allow",
6+
"Action": [
7+
"iam:CreateServiceLinkedRole"
8+
],
9+
"Resource": "*",
10+
"Condition": {
11+
"StringEquals": {
12+
"iam:AWSServiceName": "elasticloadbalancing.amazonaws.com"
13+
}
14+
}
15+
},
16+
{
17+
"Effect": "Allow",
18+
"Action": [
19+
"ec2:DescribeAccountAttributes",
20+
"ec2:DescribeAddresses",
21+
"ec2:DescribeAvailabilityZones",
22+
"ec2:DescribeInternetGateways",
23+
"ec2:DescribeVpcs",
24+
"ec2:DescribeVpcPeeringConnections",
25+
"ec2:DescribeSubnets",
26+
"ec2:DescribeSecurityGroups",
27+
"ec2:DescribeInstances",
28+
"ec2:DescribeNetworkInterfaces",
29+
"ec2:DescribeTags",
30+
"ec2:GetCoipPoolUsage",
31+
"ec2:DescribeCoipPools",
32+
"ec2:GetSecurityGroupsForVpc",
33+
"elasticloadbalancing:DescribeLoadBalancers",
34+
"elasticloadbalancing:DescribeLoadBalancerAttributes",
35+
"elasticloadbalancing:DescribeListeners",
36+
"elasticloadbalancing:DescribeListenerCertificates",
37+
"elasticloadbalancing:DescribeSSLPolicies",
38+
"elasticloadbalancing:DescribeRules",
39+
"elasticloadbalancing:DescribeTargetGroups",
40+
"elasticloadbalancing:DescribeTargetGroupAttributes",
41+
"elasticloadbalancing:DescribeTargetHealth",
42+
"elasticloadbalancing:DescribeTags"
43+
],
44+
"Resource": "*"
45+
},
46+
{
47+
"Effect": "Allow",
48+
"Action": [
49+
"cognito-idp:DescribeUserPoolClient",
50+
"acm:ListCertificates",
51+
"acm:DescribeCertificate",
52+
"iam:ListServerCertificates",
53+
"iam:GetServerCertificate",
54+
"waf-regional:GetWebACL",
55+
"waf-regional:GetWebACLForResource",
56+
"waf-regional:AssociateWebACL",
57+
"waf-regional:DisassociateWebACL",
58+
"wafv2:GetWebACL",
59+
"wafv2:GetWebACLForResource",
60+
"wafv2:AssociateWebACL",
61+
"wafv2:DisassociateWebACL",
62+
"shield:GetSubscriptionState",
63+
"shield:DescribeProtection",
64+
"shield:CreateProtection",
65+
"shield:DeleteProtection"
66+
],
67+
"Resource": "*"
68+
},
69+
{
70+
"Effect": "Allow",
71+
"Action": [
72+
"ec2:AuthorizeSecurityGroupIngress",
73+
"ec2:RevokeSecurityGroupIngress"
74+
],
75+
"Resource": "*"
76+
},
77+
{
78+
"Effect": "Allow",
79+
"Action": [
80+
"ec2:CreateSecurityGroup"
81+
],
82+
"Resource": "*"
83+
},
84+
{
85+
"Effect": "Allow",
86+
"Action": [
87+
"ec2:CreateTags"
88+
],
89+
"Resource": "arn:aws-iso-e:ec2:*:*:security-group/*",
90+
"Condition": {
91+
"StringEquals": {
92+
"ec2:CreateAction": "CreateSecurityGroup"
93+
},
94+
"Null": {
95+
"aws:RequestTag/elbv2.k8s.aws/cluster": "false"
96+
}
97+
}
98+
},
99+
{
100+
"Effect": "Allow",
101+
"Action": [
102+
"ec2:CreateTags",
103+
"ec2:DeleteTags"
104+
],
105+
"Resource": "arn:aws-iso-e:ec2:*:*:security-group/*",
106+
"Condition": {
107+
"Null": {
108+
"aws:RequestTag/elbv2.k8s.aws/cluster": "true",
109+
"aws:ResourceTag/elbv2.k8s.aws/cluster": "false"
110+
}
111+
}
112+
},
113+
{
114+
"Effect": "Allow",
115+
"Action": [
116+
"ec2:AuthorizeSecurityGroupIngress",
117+
"ec2:RevokeSecurityGroupIngress",
118+
"ec2:DeleteSecurityGroup"
119+
],
120+
"Resource": "*",
121+
"Condition": {
122+
"Null": {
123+
"aws:ResourceTag/elbv2.k8s.aws/cluster": "false"
124+
}
125+
}
126+
},
127+
{
128+
"Effect": "Allow",
129+
"Action": [
130+
"elasticloadbalancing:CreateLoadBalancer",
131+
"elasticloadbalancing:CreateTargetGroup"
132+
],
133+
"Resource": "*",
134+
"Condition": {
135+
"Null": {
136+
"aws:RequestTag/elbv2.k8s.aws/cluster": "false"
137+
}
138+
}
139+
},
140+
{
141+
"Effect": "Allow",
142+
"Action": [
143+
"elasticloadbalancing:CreateListener",
144+
"elasticloadbalancing:DeleteListener",
145+
"elasticloadbalancing:CreateRule",
146+
"elasticloadbalancing:DeleteRule"
147+
],
148+
"Resource": "*"
149+
},
150+
{
151+
"Effect": "Allow",
152+
"Action": [
153+
"elasticloadbalancing:AddTags",
154+
"elasticloadbalancing:RemoveTags"
155+
],
156+
"Resource": [
157+
"arn:aws-iso-e:elasticloadbalancing:*:*:targetgroup/*/*",
158+
"arn:aws-iso-e:elasticloadbalancing:*:*:loadbalancer/net/*/*",
159+
"arn:aws-iso-e:elasticloadbalancing:*:*:loadbalancer/app/*/*"
160+
],
161+
"Condition": {
162+
"Null": {
163+
"aws:RequestTag/elbv2.k8s.aws/cluster": "true",
164+
"aws:ResourceTag/elbv2.k8s.aws/cluster": "false"
165+
}
166+
}
167+
},
168+
{
169+
"Effect": "Allow",
170+
"Action": [
171+
"elasticloadbalancing:AddTags",
172+
"elasticloadbalancing:RemoveTags"
173+
],
174+
"Resource": [
175+
"arn:aws-iso-e:elasticloadbalancing:*:*:listener/net/*/*/*",
176+
"arn:aws-iso-e:elasticloadbalancing:*:*:listener/app/*/*/*",
177+
"arn:aws-iso-e:elasticloadbalancing:*:*:listener-rule/net/*/*/*",
178+
"arn:aws-iso-e:elasticloadbalancing:*:*:listener-rule/app/*/*/*"
179+
]
180+
},
181+
{
182+
"Effect": "Allow",
183+
"Action": [
184+
"elasticloadbalancing:AddTags"
185+
],
186+
"Resource": [
187+
"arn:aws-iso-e:elasticloadbalancing:*:*:targetgroup/*/*",
188+
"arn:aws-iso-e:elasticloadbalancing:*:*:loadbalancer/net/*/*",
189+
"arn:aws-iso-e:elasticloadbalancing:*:*:loadbalancer/app/*/*"
190+
],
191+
"Condition": {
192+
"StringEquals": {
193+
"elasticloadbalancing:CreateAction": [
194+
"CreateTargetGroup",
195+
"CreateLoadBalancer"
196+
]
197+
},
198+
"Null": {
199+
"aws:RequestTag/elbv2.k8s.aws/cluster": "false"
200+
}
201+
}
202+
},
203+
{
204+
"Effect": "Allow",
205+
"Action": [
206+
"elasticloadbalancing:ModifyLoadBalancerAttributes",
207+
"elasticloadbalancing:SetIpAddressType",
208+
"elasticloadbalancing:SetSecurityGroups",
209+
"elasticloadbalancing:SetSubnets",
210+
"elasticloadbalancing:DeleteLoadBalancer",
211+
"elasticloadbalancing:ModifyTargetGroup",
212+
"elasticloadbalancing:ModifyTargetGroupAttributes",
213+
"elasticloadbalancing:DeleteTargetGroup"
214+
],
215+
"Resource": "*",
216+
"Condition": {
217+
"Null": {
218+
"aws:ResourceTag/elbv2.k8s.aws/cluster": "false"
219+
}
220+
}
221+
},
222+
{
223+
"Effect": "Allow",
224+
"Action": [
225+
"elasticloadbalancing:RegisterTargets",
226+
"elasticloadbalancing:DeregisterTargets"
227+
],
228+
"Resource": "arn:aws-iso-e:elasticloadbalancing:*:*:targetgroup/*/*"
229+
},
230+
{
231+
"Effect": "Allow",
232+
"Action": [
233+
"elasticloadbalancing:SetWebAcl",
234+
"elasticloadbalancing:ModifyListener",
235+
"elasticloadbalancing:AddListenerCertificates",
236+
"elasticloadbalancing:RemoveListenerCertificates",
237+
"elasticloadbalancing:ModifyRule"
238+
],
239+
"Resource": "*"
240+
}
241+
]
242+
}

0 commit comments

Comments
 (0)