Update detected

zoph-io · Jan 13, 2025 · ba61ee4 · ba61ee4
1 parent e8386f1
commit ba61ee4
Showing 1 changed file with 60 additions and 13 deletions.
diff --git a/policies/AmazonEBSCSIDriverPolicy b/policies/AmazonEBSCSIDriverPolicy
@@ -1,16 +1,12 @@
 {
     "PolicyVersion": {
-        "CreateDate": "2022-11-18T14:42:46Z", 
-        "VersionId": "v2", 
+        "CreateDate": "2025-01-13T17:07:06Z", 
+        "VersionId": "v3", 
         "Document": {
             "Version": "2012-10-17", 
             "Statement": [
                 {
                     "Action": [
-                        "ec2:CreateSnapshot", 
-                        "ec2:AttachVolume", 
-                        "ec2:DetachVolume", 
-                        "ec2:ModifyVolume", 
                         "ec2:DescribeAvailabilityZones", 
                         "ec2:DescribeInstances", 
                         "ec2:DescribeSnapshots", 
@@ -21,6 +17,33 @@
                     "Resource": "*", 
                     "Effect": "Allow"
                 }, 
+                {
+                    "Action": [
+                        "ec2:CreateSnapshot", 
+                        "ec2:ModifyVolume"
+                    ], 
+                    "Resource": "arn:aws:ec2:*:*:volume/*", 
+                    "Effect": "Allow"
+                }, 
+                {
+                    "Action": [
+                        "ec2:AttachVolume", 
+                        "ec2:DetachVolume"
+                    ], 
+                    "Resource": [
+                        "arn:aws:ec2:*:*:volume/*", 
+                        "arn:aws:ec2:*:*:instance/*"
+                    ], 
+                    "Effect": "Allow"
+                }, 
+                {
+                    "Action": [
+                        "ec2:CreateVolume", 
+                        "ec2:EnableFastSnapshotRestores"
+                    ], 
+                    "Resource": "arn:aws:ec2:*:*:snapshot/*", 
+                    "Effect": "Allow"
+                }, 
                 {
                     "Action": [
                         "ec2:CreateTags"
@@ -53,7 +76,7 @@
                     "Action": [
                         "ec2:CreateVolume"
                     ], 
-                    "Resource": "*", 
+                    "Resource": "arn:aws:ec2:*:*:volume/*", 
                     "Effect": "Allow", 
                     "Condition": {
                         "StringLike": {
@@ -65,7 +88,7 @@
                     "Action": [
                         "ec2:CreateVolume"
                     ], 
-                    "Resource": "*", 
+                    "Resource": "arn:aws:ec2:*:*:volume/*", 
                     "Effect": "Allow", 
                     "Condition": {
                         "StringLike": {
@@ -77,7 +100,7 @@
                     "Action": [
                         "ec2:DeleteVolume"
                     ], 
-                    "Resource": "*", 
+                    "Resource": "arn:aws:ec2:*:*:volume/*", 
                     "Effect": "Allow", 
                     "Condition": {
                         "StringLike": {
@@ -89,7 +112,7 @@
                     "Action": [
                         "ec2:DeleteVolume"
                     ], 
-                    "Resource": "*", 
+                    "Resource": "arn:aws:ec2:*:*:volume/*", 
                     "Effect": "Allow", 
                     "Condition": {
                         "StringLike": {
@@ -101,19 +124,43 @@
                     "Action": [
                         "ec2:DeleteVolume"
                     ], 
-                    "Resource": "*", 
+                    "Resource": "arn:aws:ec2:*:*:volume/*", 
                     "Effect": "Allow", 
                     "Condition": {
                         "StringLike": {
                             "ec2:ResourceTag/kubernetes.io/created-for/pvc/name": "*"
                         }
                     }
                 }, 
+                {
+                    "Action": [
+                        "ec2:CreateSnapshot"
+                    ], 
+                    "Resource": "arn:aws:ec2:*:*:snapshot/*", 
+                    "Effect": "Allow", 
+                    "Condition": {
+                        "StringLike": {
+                            "aws:RequestTag/CSIVolumeSnapshotName": "*"
+                        }
+                    }
+                }, 
+                {
+                    "Action": [
+                        "ec2:CreateSnapshot"
+                    ], 
+                    "Resource": "arn:aws:ec2:*:*:snapshot/*", 
+                    "Effect": "Allow", 
+                    "Condition": {
+                        "StringLike": {
+                            "aws:RequestTag/ebs.csi.aws.com/cluster": "true"
+                        }
+                    }
+                }, 
                 {
                     "Action": [
                         "ec2:DeleteSnapshot"
                     ], 
-                    "Resource": "*", 
+                    "Resource": "arn:aws:ec2:*:*:snapshot/*", 
                     "Effect": "Allow", 
                     "Condition": {
                         "StringLike": {
@@ -125,7 +172,7 @@
                     "Action": [
                         "ec2:DeleteSnapshot"
                     ], 
-                    "Resource": "*", 
+                    "Resource": "arn:aws:ec2:*:*:snapshot/*", 
                     "Effect": "Allow", 
                     "Condition": {
                         "StringLike": {