[v9] Add S3:AbortMultipartUpload to AWS IAM policies (#13235)

Searched for all locations where s3:ListBucketMultipartUploads is currently required and added it. Co-authored-by: Gus Luxton <[email protected]>
gravitational · Jun 7, 2022 · f2b5527 · f2b5527
1 parent 526253e
commit f2b5527
Show file tree

Hide file tree

Showing 5 changed files with 9 additions and 2 deletions.
diff --git a/docs/pages/kubernetes-access/helm/guides/aws.mdx b/docs/pages/kubernetes-access/helm/guides/aws.mdx
@@ -121,6 +121,7 @@ You'll need to replace these values in the policy example below:
                 "s3:GetObjectRetention",
                 "s3:ListBucketVersions",
                 "s3:ListBucketMultipartUploads",
+                "s3:AbortMultipartUpload",
                 "s3:CreateBucket",
                 "s3:ListBucket",
                 "s3:GetBucketVersioning",

diff --git a/examples/aws/cloudformation/ent.yaml b/examples/aws/cloudformation/ent.yaml
@@ -731,6 +731,7 @@ Resources:
             - "s3:ListBucket"
             - "s3:ListBucketVersions"
             - "s3:ListBucketMultipartUploads"
+            - "s3:AbortMultipartUpload"
 
           -
             Effect: "Allow"
@@ -818,6 +819,7 @@ Resources:
             - "s3:ListBucket"
             - "s3:ListBucketVersions"
             - "s3:ListBucketMultipartUploads"
+            - "s3:AbortMultipartUpload"
 
           -
             Effect: "Allow"

diff --git a/examples/aws/cloudformation/oss.yaml b/examples/aws/cloudformation/oss.yaml
@@ -731,6 +731,7 @@ Resources:
             - "s3:ListBucket"
             - "s3:ListBucketVersions"
             - "s3:ListBucketMultipartUploads"
+            - "s3:AbortMultipartUpload"
 
           -
             Effect: "Allow"
@@ -818,6 +819,7 @@ Resources:
             - "s3:ListBucket"
             - "s3:ListBucketVersions"
             - "s3:ListBucketMultipartUploads"
+            - "s3:AbortMultipartUpload"
 
           -
             Effect: "Allow"

diff --git a/examples/aws/terraform/ha-autoscale-cluster/auth_iam.tf b/examples/aws/terraform/ha-autoscale-cluster/auth_iam.tf
@@ -136,7 +136,8 @@ resource "aws_iam_role_policy" "auth_s3" {
        "Action": [
          "s3:ListBucket",
          "s3:ListBucketVersions",
-         "s3:ListBucketMultipartUploads"
+         "s3:ListBucketMultipartUploads",
+         "s3:AbortMultipartUpload"
         ],
        "Resource": ["arn:aws:s3:::${aws_s3_bucket.certs.bucket}"]
      },

diff --git a/examples/aws/terraform/starter-cluster/cluster_iam.tf b/examples/aws/terraform/starter-cluster/cluster_iam.tf
@@ -44,7 +44,8 @@ resource "aws_iam_role_policy" "cluster_s3" {
        "Action": [
          "s3:ListBucket",
          "s3:ListBucketVersions",
-         "s3:ListBucketMultipartUploads"
+         "s3:ListBucketMultipartUploads",
+         "s3:AbortMultipartUpload"
       ],
        "Resource": ["arn:aws:s3:::${aws_s3_bucket.storage.bucket}"]
      },