Merge pull request #16412 from orbit-online/tighten-cert-manager-aws-…

…permissions aws/cert-manager: Tighten IAM permissions for cert-manager
kubernetes · Mar 19, 2024 · 305e9b2 · 305e9b2
2 parents db26ad5 + a902f9e
commit 305e9b2
Showing 1 changed file with 16 additions and 4 deletions.
diff --git a/pkg/model/components/addonmanifests/certmanager/iam.go b/pkg/model/components/addonmanifests/certmanager/iam.go
@@ -56,11 +56,23 @@ func addCertManagerPermissions(b *iam.PolicyBuilder, p *iam.Policy) {
 	}
 
 	p.Statement = append(p.Statement, &iam.Statement{
-		Effect: iam.StatementEffectAllow,
-		Action: stringorset.Of("route53:ChangeResourceRecordSets",
-			"route53:ListResourceRecordSets",
-		),
+		Effect:   iam.StatementEffectAllow,
+		Action:   stringorset.Of("route53:ListResourceRecordSets"),
+		Resource: stringorset.Set(zoneResources),
+	})
+
+	p.Statement = append(p.Statement, &iam.Statement{
+		Effect:   iam.StatementEffectAllow,
+		Action:   stringorset.Of("route53:ChangeResourceRecordSets"),
 		Resource: stringorset.Set(zoneResources),
+		Condition: iam.Condition{
+			"ForAllValues:StringLike": map[string]interface{}{
+				"route53:ChangeResourceRecordSetsNormalizedRecordNames": []string{"_acme-challenge.*"},
+			},
+			"ForAllValues:StringEquals": map[string]interface{}{
+				"route53:ChangeResourceRecordSetsRecordTypes": []string{"TXT"},
+			},
+		},
 	})
 
 	p.Statement = append(p.Statement, &iam.Statement{