controller-credentials-request.yaml

apiVersion: cloudcredential.openshift.io/v1
kind: CredentialsRequest
metadata:
  name: aws-load-balancer-controller
  namespace: openshift-cloud-credential-operator
spec:
  providerSpec:
    apiVersion: cloudcredential.openshift.io/v1
    kind: AWSProviderSpec
    statementEntries:
    - action:
      - iam:CreateServiceLinkedRole
      effect: Allow
      resource: "*"
      policyCondition:
          "StringEquals":
              "iam:AWSServiceName": "elasticloadbalancing.amazonaws.com"
    - action:
      - ec2:DescribeAccountAttributes
      - ec2:DescribeAddresses
      - ec2:DescribeAvailabilityZones
      - ec2:DescribeInternetGateways
      - ec2:DescribeVpcs
      - ec2:DescribeVpcPeeringConnections
      - ec2:DescribeSubnets
      - ec2:DescribeSecurityGroups
      - ec2:DescribeInstances
      - ec2:DescribeNetworkInterfaces
      - ec2:DescribeTags
      - ec2:GetCoipPoolUsage
      - ec2:DescribeCoipPools
      - elasticloadbalancing:DescribeLoadBalancers
      - elasticloadbalancing:DescribeLoadBalancerAttributes
      - elasticloadbalancing:DescribeListeners
      - elasticloadbalancing:DescribeListenerCertificates
      - elasticloadbalancing:DescribeSSLPolicies
      - elasticloadbalancing:DescribeRules
      - elasticloadbalancing:DescribeTargetGroups
      - elasticloadbalancing:DescribeTargetGroupAttributes
      - elasticloadbalancing:DescribeTargetHealth
      - elasticloadbalancing:DescribeTags
      - elasticloadbalancing:DescribeTrustStores
      effect: Allow
      resource: "*"
    - action:
      - cognito-idp:DescribeUserPoolClient
      - acm:ListCertificates
      - acm:DescribeCertificate
      - iam:ListServerCertificates
      - iam:GetServerCertificate
      - waf-regional:GetWebACL
      - waf-regional:GetWebACLForResource
      - waf-regional:AssociateWebACL
      - waf-regional:DisassociateWebACL
      - wafv2:GetWebACL
      - wafv2:GetWebACLForResource
      - wafv2:AssociateWebACL
      - wafv2:DisassociateWebACL
      - shield:GetSubscriptionState
      - shield:DescribeProtection
      - shield:CreateProtection
      - shield:DeleteProtection
      effect: Allow
      resource: "*"
    - action:
      - ec2:AuthorizeSecurityGroupIngress
      - ec2:RevokeSecurityGroupIngress
      effect: Allow
      resource: "*"
    - action:
      - ec2:CreateSecurityGroup
      effect: Allow
      resource: "*"
    - action:
      - ec2:CreateTags
      effect: Allow
      resource: "arn:aws:ec2:*:*:security-group/*"
      policyCondition:
          "Null":
              "aws:RequestTag/elbv2.k8s.aws/cluster": "false"
          "StringEquals":
              "ec2:CreateAction": "CreateSecurityGroup"
    - action:
      - ec2:CreateTags
      - ec2:DeleteTags
      effect: Allow
      resource: "arn:aws:ec2:*:*:security-group/*"
      policyCondition:
          "Null":
              "aws:RequestTag/elbv2.k8s.aws/cluster": "true"
              "aws:ResourceTag/elbv2.k8s.aws/cluster": "false"
    - action:
      - ec2:AuthorizeSecurityGroupIngress
      - ec2:RevokeSecurityGroupIngress
      - ec2:DeleteSecurityGroup
      effect: Allow
      resource: "*"
      policyCondition:
          "Null":
              "aws:ResourceTag/elbv2.k8s.aws/cluster": "false"
    - action:
      - elasticloadbalancing:CreateLoadBalancer
      - elasticloadbalancing:CreateTargetGroup
      effect: Allow
      resource: "*"
      policyCondition:
          "Null":
              "aws:RequestTag/elbv2.k8s.aws/cluster": "false"
    - action:
      - elasticloadbalancing:CreateListener
      - elasticloadbalancing:DeleteListener
      - elasticloadbalancing:CreateRule
      - elasticloadbalancing:DeleteRule
      effect: Allow
      resource: "*"
    - action:
      - elasticloadbalancing:AddTags
      - elasticloadbalancing:RemoveTags
      effect: Allow
      resource: "arn:aws:elasticloadbalancing:*:*:targetgroup/*/*"
      policyCondition:
          "Null":
              "aws:RequestTag/elbv2.k8s.aws/cluster": "true"
              "aws:ResourceTag/elbv2.k8s.aws/cluster": "false"
    - action:
      - elasticloadbalancing:AddTags
      - elasticloadbalancing:RemoveTags
      effect: Allow
      resource: "arn:aws:elasticloadbalancing:*:*:loadbalancer/net/*/*"
      policyCondition:
          "Null":
              "aws:RequestTag/elbv2.k8s.aws/cluster": "true"
              "aws:ResourceTag/elbv2.k8s.aws/cluster": "false"
    - action:
      - elasticloadbalancing:AddTags
      - elasticloadbalancing:RemoveTags
      effect: Allow
      resource: "arn:aws:elasticloadbalancing:*:*:loadbalancer/app/*/*"
      policyCondition:
          "Null":
              "aws:RequestTag/elbv2.k8s.aws/cluster": "true"
              "aws:ResourceTag/elbv2.k8s.aws/cluster": "false"
    - action:
      - elasticloadbalancing:AddTags
      - elasticloadbalancing:RemoveTags
      effect: Allow
      resource: "arn:aws:elasticloadbalancing:*:*:listener/net/*/*/*"
    - action:
      - elasticloadbalancing:AddTags
      - elasticloadbalancing:RemoveTags
      effect: Allow
      resource: "arn:aws:elasticloadbalancing:*:*:listener/app/*/*/*"
    - action:
      - elasticloadbalancing:AddTags
      - elasticloadbalancing:RemoveTags
      effect: Allow
      resource: "arn:aws:elasticloadbalancing:*:*:listener-rule/net/*/*/*"
    - action:
      - elasticloadbalancing:AddTags
      - elasticloadbalancing:RemoveTags
      effect: Allow
      resource: "arn:aws:elasticloadbalancing:*:*:listener-rule/app/*/*/*"
    - action:
      - elasticloadbalancing:AddTags
      effect: Allow
      resource: "arn:aws:elasticloadbalancing:*:*:targetgroup/*/*"
      policyCondition:
          "Null":
              "aws:RequestTag/elbv2.k8s.aws/cluster": "false"
          "StringEquals":
              "elasticloadbalancing:CreateAction": ["CreateTargetGroup","CreateLoadBalancer"]
    - action:
      - elasticloadbalancing:AddTags
      effect: Allow
      resource: "arn:aws:elasticloadbalancing:*:*:loadbalancer/net/*/*"
      policyCondition:
          "Null":
              "aws:RequestTag/elbv2.k8s.aws/cluster": "false"
          "StringEquals":
              "elasticloadbalancing:CreateAction": ["CreateTargetGroup","CreateLoadBalancer"]
    - action:
      - elasticloadbalancing:AddTags
      effect: Allow
      resource: "arn:aws:elasticloadbalancing:*:*:loadbalancer/app/*/*"
      policyCondition:
          "Null":
              "aws:RequestTag/elbv2.k8s.aws/cluster": "false"
          "StringEquals":
              "elasticloadbalancing:CreateAction": ["CreateTargetGroup","CreateLoadBalancer"]
    - action:
      - elasticloadbalancing:ModifyLoadBalancerAttributes
      - elasticloadbalancing:SetIpAddressType
      - elasticloadbalancing:SetSecurityGroups
      - elasticloadbalancing:SetSubnets
      - elasticloadbalancing:DeleteLoadBalancer
      - elasticloadbalancing:ModifyTargetGroup
      - elasticloadbalancing:ModifyTargetGroupAttributes
      - elasticloadbalancing:DeleteTargetGroup
      effect: Allow
      resource: "*"
      policyCondition:
          "Null":
              "aws:ResourceTag/elbv2.k8s.aws/cluster": "false"
    - action:
      - elasticloadbalancing:RegisterTargets
      - elasticloadbalancing:DeregisterTargets
      effect: Allow
      resource: "arn:aws:elasticloadbalancing:*:*:targetgroup/*/*"
    - action:
      - elasticloadbalancing:SetWebAcl
      - elasticloadbalancing:ModifyListener
      - elasticloadbalancing:AddListenerCertificates
      - elasticloadbalancing:RemoveListenerCertificates
      - elasticloadbalancing:ModifyRule
      effect: Allow
      resource: "*"
  secretRef:
    name: aws-load-balancer-controller-cluster
    namespace: aws-load-balancer-operator
  serviceAccountNames:
  - aws-load-balancer-controller-cluster