openshift / aws-account-operator

Operator to manage pool of AWS accounts for Hive
Apache License 2.0
32 stars 75 forks source link

[OSD-7720] Fix AWS Federated Account Access from leaking Policies #617

Closed dastergon closed 3 years ago

dastergon commented 3 years ago

In the AWS Federated Account Access controller, there was a code for deleting policies after all operations are done, but due to a wrong check between the policy name and the actual attached policy name, the condition was never met and the deletion path was not executed and that lead to leaking policies. The issue was that the attached policy in AWS has a uid label as a suffix appended to the actual policy name.

Example format:

But the policy name in the if the condition was just BillingReadOnlyAccess. This PR fixes the policy leaking.

PTAL See: https://issues.redhat.com/browse/OSD-7720

codecov-commenter commented 3 years ago

Codecov Report

Merging #617 (0c17c16) into master (545cc86) will decrease coverage by 0.00%. The diff coverage is 0.00%.

Impacted file tree graph

@@            Coverage Diff             @@
##           master     #617      +/-   ##
==========================================
- Coverage   14.52%   14.51%   -0.01%     
==========================================
  Files          45       45              
  Lines        4325     4326       +1     
==========================================
  Hits          628      628              
- Misses       3673     3674       +1     
  Partials       24       24              
Impacted Files Coverage Δ
...ountaccess/awsfederatedaccountaccess_controller.go 0.00% <0.00%> (ø)
...er/awsfederatedrole/awsfederatedrole_controller.go 0.00% <ø> (ø)
lisa commented 3 years ago

/approve /lgtm

Dan will write up a card to do the improvements he mentioned in his comment.

openshift-ci[bot] commented 3 years ago

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: dastergon, fahlmant, lisa

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files: - ~~[OWNERS](https://github.com/openshift/aws-account-operator/blob/master/OWNERS)~~ [lisa] Approvers can indicate their approval by writing `/approve` in a comment Approvers can cancel approval by writing `/approve cancel` in a comment