From 252ca62a76c86428ee8a0171c77a857f7df80149 Mon Sep 17 00:00:00 2001 From: Gus Luxton Date: Tue, 7 Jun 2022 09:28:12 -0300 Subject: [PATCH] Add S3:AbortMultipartUpload to AWS IAM policies (#13213) * Add S3:AbortMultipartUploads to AWS IAM policies Searched for all locations where s3:ListBucketMultipartUploads is currently required and added it. * Fix permission name (it's singular) --- docs/pages/kubernetes-access/helm/guides/aws.mdx | 1 + examples/aws/cloudformation/ent.yaml | 2 ++ examples/aws/cloudformation/oss.yaml | 2 ++ examples/aws/terraform/ha-autoscale-cluster/auth_iam.tf | 3 ++- examples/aws/terraform/starter-cluster/cluster_iam.tf | 3 ++- 5 files changed, 9 insertions(+), 2 deletions(-) diff --git a/docs/pages/kubernetes-access/helm/guides/aws.mdx b/docs/pages/kubernetes-access/helm/guides/aws.mdx index 0dc9eb685bf..a36a073dfe5 100644 --- a/docs/pages/kubernetes-access/helm/guides/aws.mdx +++ b/docs/pages/kubernetes-access/helm/guides/aws.mdx @@ -144,6 +144,7 @@ You'll need to replace these values in the policy example below: "s3:GetObjectRetention", "s3:ListBucketVersions", "s3:ListBucketMultipartUploads", + "s3:AbortMultipartUpload", "s3:CreateBucket", "s3:ListBucket", "s3:GetBucketVersioning", diff --git a/examples/aws/cloudformation/ent.yaml b/examples/aws/cloudformation/ent.yaml index 43d35db5d4f..ced9daab8da 100644 --- a/examples/aws/cloudformation/ent.yaml +++ b/examples/aws/cloudformation/ent.yaml @@ -731,6 +731,7 @@ Resources: - "s3:ListBucket" - "s3:ListBucketVersions" - "s3:ListBucketMultipartUploads" + - "s3:AbortMultipartUpload" - Effect: "Allow" @@ -818,6 +819,7 @@ Resources: - "s3:ListBucket" - "s3:ListBucketVersions" - "s3:ListBucketMultipartUploads" + - "s3:AbortMultipartUpload" - Effect: "Allow" diff --git a/examples/aws/cloudformation/oss.yaml b/examples/aws/cloudformation/oss.yaml index b13e4e3522c..d60ba4a579b 100644 --- a/examples/aws/cloudformation/oss.yaml +++ b/examples/aws/cloudformation/oss.yaml @@ -731,6 +731,7 @@ Resources: - "s3:ListBucket" - "s3:ListBucketVersions" - "s3:ListBucketMultipartUploads" + - "s3:AbortMultipartUpload" - Effect: "Allow" @@ -818,6 +819,7 @@ Resources: - "s3:ListBucket" - "s3:ListBucketVersions" - "s3:ListBucketMultipartUploads" + - "s3:AbortMultipartUpload" - Effect: "Allow" diff --git a/examples/aws/terraform/ha-autoscale-cluster/auth_iam.tf b/examples/aws/terraform/ha-autoscale-cluster/auth_iam.tf index 07ac312451d..ed00a078aa7 100644 --- a/examples/aws/terraform/ha-autoscale-cluster/auth_iam.tf +++ b/examples/aws/terraform/ha-autoscale-cluster/auth_iam.tf @@ -136,7 +136,8 @@ resource "aws_iam_role_policy" "auth_s3" { "Action": [ "s3:ListBucket", "s3:ListBucketVersions", - "s3:ListBucketMultipartUploads" + "s3:ListBucketMultipartUploads", + "s3:AbortMultipartUpload" ], "Resource": ["arn:aws:s3:::${aws_s3_bucket.certs.bucket}"] }, diff --git a/examples/aws/terraform/starter-cluster/cluster_iam.tf b/examples/aws/terraform/starter-cluster/cluster_iam.tf index 29d477f85de..d97a8029cd3 100644 --- a/examples/aws/terraform/starter-cluster/cluster_iam.tf +++ b/examples/aws/terraform/starter-cluster/cluster_iam.tf @@ -44,7 +44,8 @@ resource "aws_iam_role_policy" "cluster_s3" { "Action": [ "s3:ListBucket", "s3:ListBucketVersions", - "s3:ListBucketMultipartUploads" + "s3:ListBucketMultipartUploads", + "s3:AbortMultipartUpload" ], "Resource": ["arn:aws:s3:::${aws_s3_bucket.storage.bucket}"] },