feat: Update AWS EBS CSI Driver IAM Policy (#530)

terraform-aws-modules · Oct 21, 2024 · 1bc058c · 1bc058c · sjtindell · Oct 22, 2024
1 parent 15fd175
commit 1bc058c
Showing 1 changed file with 7 additions and 2 deletions.
diff --git a/modules/iam-role-for-service-accounts-eks/policies.tf b/modules/iam-role-for-service-accounts-eks/policies.tf
@@ -200,7 +200,7 @@ data "aws_iam_policy_document" "ebs_csi" {
 
   statement {
     actions   = ["ec2:CreateVolume"]
-    resources = ["*"]
+    resources = ["arn:aws:ec2:*:*:volume/*"]
 
     condition {
       test     = "StringLike"
@@ -213,7 +213,7 @@ data "aws_iam_policy_document" "ebs_csi" {
 
   statement {
     actions   = ["ec2:CreateVolume"]
-    resources = ["*"]
+    resources = ["arn:aws:ec2:*:*:volume/*"]
 
     condition {
       test     = "StringLike"
@@ -233,6 +233,11 @@ data "aws_iam_policy_document" "ebs_csi" {
     }
   }
 
+  statement {
+    actions   = ["ec2:CreateVolume"]
+    resources = ["arn:aws:ec2:*:*:snapshot/*"]
+  }
+
   statement {
     actions   = ["ec2:DeleteVolume"]
     resources = ["*"]