Merge pull request #6655 from Himangini/update-iam-policy

Updated IAM policy statement for loadbalancer controller
eksctl-io · May 31, 2023 · 52d3eed · 52d3eed
2 parents dad16d7 + 3d95c5a
commit 52d3eed
Showing 1 changed file with 22 additions and 0 deletions.
diff --git a/pkg/cfn/builder/statement.go b/pkg/cfn/builder/statement.go
@@ -84,6 +84,28 @@ func loadBalancerControllerStatements() []cft.MapOfInterfaces {
 				"elasticloadbalancing:RemoveTags",
 			},
 		},
+		{
+			"Effect": effectAllow,
+			"Action": []string{
+				"elasticloadbalancing:AddTags",
+			},
+			"Resource": []*gfnt.Value{
+				addARNPartitionPrefix("elasticloadbalancing:*:*:targetgroup/*/*"),
+				addARNPartitionPrefix("elasticloadbalancing:*:*:loadbalancer/net/*/*"),
+				addARNPartitionPrefix("elasticloadbalancing:*:*:loadbalancer/app/*/*"),
+			},
+			"Condition": map[string]interface{}{
+				"StringEquals": map[string]interface{}{
+					"elasticloadbalancing:CreateAction": []string{
+						"CreateTargetGroup",
+						"CreateLoadBalancer",
+					},
+				},
+				"Null": map[string]string{
+					"aws:RequestTag/elbv2.k8s.aws/cluster": "false",
+				},
+			},
+		},
 		{
 			"Effect":   effectAllow,
 			"Resource": resourceAll,