[WIP] Scope down IAM policy

ConnorJC3 commented 4 days ago

What type of PR is this?

/kind cleanup /kind documentation

What is this PR about? / Why do we need it?

Updates the example IAM policy with the following changes:

Reverts from * partition to aws partition for consistency with the managed policy (TODO: Add documentation about this - will be done in a future revision of the PR)
Moves mutating actions from * resource to more specific resources
Consolidates some statements that can be combined with ForAnyValue
Restricts modification of tags to only allow adding managed tags during volume/snapshot creation

How was this change tested?

Manually + CI

Does this PR introduce a user-facing change?

TODO - WIP

k8s-ci-robot commented 4 days ago

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: Once this PR has been reviewed and has the lgtm label, please ask for approval from connorjc3. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files: - **[OWNERS](https://github.com/kubernetes-sigs/aws-ebs-csi-driver/blob/master/OWNERS)** Approvers can indicate their approval by writing `/approve` in a comment Approvers can cancel approval by writing `/approve cancel` in a comment

github-actions[bot] commented 4 days ago

Code Coverage Diff

This PR does not change the code coverage

torredil commented 4 days ago

/retest

torredil commented 3 days ago

/lgtm

kubernetes-sigs / aws-ebs-csi-driver