Skip to content

Commit 18344d8

Browse files
cPu1cPu1
authored
Merge pull request #7988 from jonathanfoster/fix-missing-elb-listener-attributes-actions
Fix missing ELB listener attribute actions required for AWS Load Balancer Controller v2.9.0
2 parents 65428f9 + d9c9b2e commit 18344d8

File tree

2 files changed

+273
-0
lines changed

2 files changed

+273
-0
lines changed

‎pkg/cfn/builder/iam_test.go‎

Lines changed: 271 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -295,6 +295,7 @@ var _ = Describe("template builder for IAM", func() {
295295
}
296296
]`))
297297
Expect(t).To(HaveOutputWithValue(outputs.IAMServiceAccountRoleName, `{ "Fn::GetAtt": "Role1.Arn" }`))
298+
Expect(t).To(HaveResourceWithPropertyValue("PolicyAWSLoadBalancerController", "PolicyDocument", expectedAWSLoadBalancerControllerPolicyDocument))
298299
Expect(t).To(HaveResourceWithPropertyValue("PolicyEBSCSIController", "PolicyDocument", expectedEbsPolicyDocument))
299300
})
300301

@@ -467,6 +468,276 @@ const expectedAssumeRolePolicyDocument = `{
467468
"Version": "2012-10-17"
468469
}`
469470

471+
const expectedAWSLoadBalancerControllerPolicyDocument = `{
472+
"Statement": [
473+
{
474+
"Action": [
475+
"iam:CreateServiceLinkedRole"
476+
],
477+
"Condition": {
478+
"StringEquals": {
479+
"iam:AWSServiceName": "elasticloadbalancing.amazonaws.com"
480+
}
481+
},
482+
"Effect": "Allow",
483+
"Resource": "*"
484+
},
485+
{
486+
"Action": [
487+
"ec2:DescribeAccountAttributes",
488+
"ec2:DescribeAddresses",
489+
"ec2:DescribeAvailabilityZones",
490+
"ec2:DescribeInternetGateways",
491+
"ec2:DescribeVpcs",
492+
"ec2:DescribeVpcPeeringConnections",
493+
"ec2:DescribeSubnets",
494+
"ec2:DescribeSecurityGroups",
495+
"ec2:DescribeInstances",
496+
"ec2:DescribeNetworkInterfaces",
497+
"ec2:DescribeTags",
498+
"ec2:GetCoipPoolUsage",
499+
"ec2:DescribeCoipPools",
500+
"elasticloadbalancing:DescribeLoadBalancers",
501+
"elasticloadbalancing:DescribeLoadBalancerAttributes",
502+
"elasticloadbalancing:DescribeListeners",
503+
"elasticloadbalancing:DescribeListenerAttributes",
504+
"elasticloadbalancing:DescribeListenerCertificates",
505+
"elasticloadbalancing:DescribeSSLPolicies",
506+
"elasticloadbalancing:DescribeRules",
507+
"elasticloadbalancing:DescribeTargetGroups",
508+
"elasticloadbalancing:DescribeTargetGroupAttributes",
509+
"elasticloadbalancing:DescribeTargetHealth",
510+
"elasticloadbalancing:DescribeTags"
511+
],
512+
"Effect": "Allow",
513+
"Resource": "*"
514+
},
515+
{
516+
"Action": [
517+
"cognito-idp:DescribeUserPoolClient",
518+
"acm:ListCertificates",
519+
"acm:DescribeCertificate",
520+
"iam:ListServerCertificates",
521+
"iam:GetServerCertificate",
522+
"waf-regional:GetWebACL",
523+
"waf-regional:GetWebACLForResource",
524+
"waf-regional:AssociateWebACL",
525+
"waf-regional:DisassociateWebACL",
526+
"wafv2:GetWebACL",
527+
"wafv2:GetWebACLForResource",
528+
"wafv2:AssociateWebACL",
529+
"wafv2:DisassociateWebACL",
530+
"shield:GetSubscriptionState",
531+
"shield:DescribeProtection",
532+
"shield:CreateProtection",
533+
"shield:DeleteProtection"
534+
],
535+
"Effect": "Allow",
536+
"Resource": "*"
537+
},
538+
{
539+
"Action": [
540+
"ec2:AuthorizeSecurityGroupIngress",
541+
"ec2:RevokeSecurityGroupIngress"
542+
],
543+
"Effect": "Allow",
544+
"Resource": "*"
545+
},
546+
{
547+
"Action": [
548+
"ec2:CreateSecurityGroup"
549+
],
550+
"Effect": "Allow",
551+
"Resource": "*"
552+
},
553+
{
554+
"Action": [
555+
"ec2:CreateTags"
556+
],
557+
"Condition": {
558+
"Null": {
559+
"aws:RequestTag/elbv2.k8s.aws/cluster": "false"
560+
},
561+
"StringEquals": {
562+
"ec2:CreateAction": "CreateSecurityGroup"
563+
}
564+
},
565+
"Effect": "Allow",
566+
"Resource": {
567+
"Fn::Sub": "arn:${AWS::Partition}:ec2:*:*:security-group/*"
568+
}
569+
},
570+
{
571+
"Action": [
572+
"ec2:CreateTags",
573+
"ec2:DeleteTags"
574+
],
575+
"Condition": {
576+
"Null": {
577+
"aws:RequestTag/elbv2.k8s.aws/cluster": "true",
578+
"aws:ResourceTag/elbv2.k8s.aws/cluster": "false"
579+
}
580+
},
581+
"Effect": "Allow",
582+
"Resource": {
583+
"Fn::Sub": "arn:${AWS::Partition}:ec2:*:*:security-group/*"
584+
}
585+
},
586+
{
587+
"Action": [
588+
"ec2:AuthorizeSecurityGroupIngress",
589+
"ec2:RevokeSecurityGroupIngress",
590+
"ec2:DeleteSecurityGroup"
591+
],
592+
"Condition": {
593+
"Null": {
594+
"aws:ResourceTag/elbv2.k8s.aws/cluster": "false"
595+
}
596+
},
597+
"Effect": "Allow",
598+
"Resource": "*"
599+
},
600+
{
601+
"Action": [
602+
"elasticloadbalancing:CreateLoadBalancer",
603+
"elasticloadbalancing:CreateTargetGroup"
604+
],
605+
"Condition": {
606+
"Null": {
607+
"aws:RequestTag/elbv2.k8s.aws/cluster": "false"
608+
}
609+
},
610+
"Effect": "Allow",
611+
"Resource": "*"
612+
},
613+
{
614+
"Action": [
615+
"elasticloadbalancing:CreateListener",
616+
"elasticloadbalancing:DeleteListener",
617+
"elasticloadbalancing:CreateRule",
618+
"elasticloadbalancing:DeleteRule"
619+
],
620+
"Effect": "Allow",
621+
"Resource": "*"
622+
},
623+
{
624+
"Action": [
625+
"elasticloadbalancing:AddTags",
626+
"elasticloadbalancing:RemoveTags"
627+
],
628+
"Condition": {
629+
"Null": {
630+
"aws:RequestTag/elbv2.k8s.aws/cluster": "true",
631+
"aws:ResourceTag/elbv2.k8s.aws/cluster": "false"
632+
}
633+
},
634+
"Effect": "Allow",
635+
"Resource": [
636+
{
637+
"Fn::Sub": "arn:${AWS::Partition}:elasticloadbalancing:*:*:targetgroup/*/*"
638+
},
639+
{
640+
"Fn::Sub": "arn:${AWS::Partition}:elasticloadbalancing:*:*:loadbalancer/net/*/*"
641+
},
642+
{
643+
"Fn::Sub": "arn:${AWS::Partition}:elasticloadbalancing:*:*:loadbalancer/app/*/*"
644+
}
645+
]
646+
},
647+
{
648+
"Action": [
649+
"elasticloadbalancing:AddTags",
650+
"elasticloadbalancing:RemoveTags"
651+
],
652+
"Effect": "Allow",
653+
"Resource": [
654+
{
655+
"Fn::Sub": "arn:${AWS::Partition}:elasticloadbalancing:*:*:listener/net/*/*/*"
656+
},
657+
{
658+
"Fn::Sub": "arn:${AWS::Partition}:elasticloadbalancing:*:*:listener/app/*/*/*"
659+
},
660+
{
661+
"Fn::Sub": "arn:${AWS::Partition}:elasticloadbalancing:*:*:listener-rule/net/*/*/*"
662+
},
663+
{
664+
"Fn::Sub": "arn:${AWS::Partition}:elasticloadbalancing:*:*:listener-rule/app/*/*/*"
665+
}
666+
]
667+
},
668+
{
669+
"Action": [
670+
"elasticloadbalancing:ModifyListenerAttributes",
671+
"elasticloadbalancing:ModifyLoadBalancerAttributes",
672+
"elasticloadbalancing:SetIpAddressType",
673+
"elasticloadbalancing:SetSecurityGroups",
674+
"elasticloadbalancing:SetSubnets",
675+
"elasticloadbalancing:DeleteLoadBalancer",
676+
"elasticloadbalancing:ModifyTargetGroup",
677+
"elasticloadbalancing:ModifyTargetGroupAttributes",
678+
"elasticloadbalancing:DeleteTargetGroup"
679+
],
680+
"Condition": {
681+
"Null": {
682+
"aws:ResourceTag/elbv2.k8s.aws/cluster": "false"
683+
}
684+
},
685+
"Effect": "Allow",
686+
"Resource": "*"
687+
},
688+
{
689+
"Action": [
690+
"elasticloadbalancing:AddTags"
691+
],
692+
"Condition": {
693+
"Null": {
694+
"aws:RequestTag/elbv2.k8s.aws/cluster": "false"
695+
},
696+
"StringEquals": {
697+
"elasticloadbalancing:CreateAction": [
698+
"CreateTargetGroup",
699+
"CreateLoadBalancer"
700+
]
701+
}
702+
},
703+
"Effect": "Allow",
704+
"Resource": [
705+
{
706+
"Fn::Sub": "arn:${AWS::Partition}:elasticloadbalancing:*:*:targetgroup/*/*"
707+
},
708+
{
709+
"Fn::Sub": "arn:${AWS::Partition}:elasticloadbalancing:*:*:loadbalancer/net/*/*"
710+
},
711+
{
712+
"Fn::Sub": "arn:${AWS::Partition}:elasticloadbalancing:*:*:loadbalancer/app/*/*"
713+
}
714+
]
715+
},
716+
{
717+
"Action": [
718+
"elasticloadbalancing:RegisterTargets",
719+
"elasticloadbalancing:DeregisterTargets"
720+
],
721+
"Effect": "Allow",
722+
"Resource": {
723+
"Fn::Sub": "arn:${AWS::Partition}:elasticloadbalancing:*:*:targetgroup/*/*"
724+
}
725+
},
726+
{
727+
"Action": [
728+
"elasticloadbalancing:SetWebAcl",
729+
"elasticloadbalancing:ModifyListener",
730+
"elasticloadbalancing:AddListenerCertificates",
731+
"elasticloadbalancing:RemoveListenerCertificates",
732+
"elasticloadbalancing:ModifyRule"
733+
],
734+
"Effect": "Allow",
735+
"Resource": "*"
736+
}
737+
],
738+
"Version": "2012-10-17"
739+
}`
740+
470741
const expectedEbsPolicyDocument = `{
471742
"Statement": [
472743
{

‎pkg/cfn/builder/statement.go‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,7 @@ func loadBalancerControllerStatements() []cft.MapOfInterfaces {
4242
"elasticloadbalancing:DescribeLoadBalancers",
4343
"elasticloadbalancing:DescribeLoadBalancerAttributes",
4444
"elasticloadbalancing:DescribeListeners",
45+
"elasticloadbalancing:DescribeListenerAttributes",
4546
"elasticloadbalancing:DescribeListenerCertificates",
4647
"elasticloadbalancing:DescribeSSLPolicies",
4748
"elasticloadbalancing:DescribeRules",
@@ -190,6 +191,7 @@ func loadBalancerControllerStatements() []cft.MapOfInterfaces {
190191
{
191192
"Effect": effectAllow,
192193
"Action": []string{
194+
"elasticloadbalancing:ModifyListenerAttributes",
193195
"elasticloadbalancing:ModifyLoadBalancerAttributes",
194196
"elasticloadbalancing:SetIpAddressType",
195197
"elasticloadbalancing:SetSecurityGroups",

0 commit comments

Comments
 (0)