Support setting role path and permissions boundary on managed IAM roles #5285
Description
/kind feature
Describe the solution you'd like
We use CAPA to create and manage the IAM roles for EKS and Fargate. We have the requirement that our roles must be created under a specific path, and with a permissions boundary attached. Setting a path and permissions boundary is a very common requirement in enterprise IAM environments. Unfortunately, this is not supported by CAPA.
Anything else you would like to add:
The call that creates the IAM role is located here:
// CreateRole will create a role from the IAMService.
func (s *IAMService) CreateRole(
roleName string,
key string,
trustRelationship *iamv1.PolicyDocument,
additionalTags infrav1.Tags,
) (*iam.Role, error) {
tags := RoleTags(key, additionalTags)
trustRelationshipJSON, err := converters.IAMPolicyDocumentToJSON(*trustRelationship)
if err != nil {
return nil, errors.Wrap(err, "error converting trust relationship to json")
}
input := &iam.CreateRoleInput{
RoleName: aws.String(roleName),
Tags: tags,
AssumeRolePolicyDocument: aws.String(trustRelationshipJSON),
}
out, err := s.IAMClient.CreateRole(input)
if err != nil {
return nil, errors.Wrap(err, "failed to call CreateRole")
}
return out.Role, nil
}The path and permissions boundary are both string values that must be added to CreateRoleInput.
Adding these fields to the Spec and passing them through the stack should be enough.
Environment:
- Cluster-api-provider-aws version: 2.7.1
- Kubernetes version: (use
kubectl version): N/A - OS (e.g. from
/etc/os-release): N/A