From e190622cac735c9daf986441289c285694b08658 Mon Sep 17 00:00:00 2001 From: Jonathan Dobson Date: Wed, 15 Jul 2026 10:08:48 -0600 Subject: [PATCH] OCPBUGS-97920: allow specific actions for AWS EFS CredentialsRequest --- assets/overlays/aws-efs/base/credentials.yaml | 8 +++++++- .../aws-efs/generated/standalone/credentials.yaml | 7 ++++++- 2 files changed, 13 insertions(+), 2 deletions(-) diff --git a/assets/overlays/aws-efs/base/credentials.yaml b/assets/overlays/aws-efs/base/credentials.yaml index 754558e7e..381767d03 100644 --- a/assets/overlays/aws-efs/base/credentials.yaml +++ b/assets/overlays/aws-efs/base/credentials.yaml @@ -13,7 +13,13 @@ spec: statementEntries: - effect: Allow action: - - elasticfilesystem:* + # https://github.com/openshift/aws-efs-csi-driver/blob/master/docs/iam-policy-example.json + - elasticfilesystem:DescribeAccessPoints + - elasticfilesystem:DescribeFileSystems + - elasticfilesystem:DescribeMountTargets + - elasticfilesystem:CreateAccessPoint + - elasticfilesystem:DeleteAccessPoint + - elasticfilesystem:TagResource - ec2:DescribeAvailabilityZones # for one-zone volumes resource: "*" # STS fields will be set by the operator diff --git a/assets/overlays/aws-efs/generated/standalone/credentials.yaml b/assets/overlays/aws-efs/generated/standalone/credentials.yaml index 11dfea1f7..d24376f03 100644 --- a/assets/overlays/aws-efs/generated/standalone/credentials.yaml +++ b/assets/overlays/aws-efs/generated/standalone/credentials.yaml @@ -15,7 +15,12 @@ spec: kind: AWSProviderSpec statementEntries: - action: - - elasticfilesystem:* + - elasticfilesystem:DescribeAccessPoints + - elasticfilesystem:DescribeFileSystems + - elasticfilesystem:DescribeMountTargets + - elasticfilesystem:CreateAccessPoint + - elasticfilesystem:DeleteAccessPoint + - elasticfilesystem:TagResource - ec2:DescribeAvailabilityZones effect: Allow resource: '*'