Allow machines to have encrypted EBS volumes with non-default key
@@ -32,6 +32,24 @@ spec:
- elasticloadbalancing:RegisterTargets
- iam:PassRole
resource: "*"
+ - effect: Allow
+ action:
+ - kms:Decrypt
+ - kms:Encrypt
+ - kms:GenerateDataKey
+ - kms:GenerateDataKeyWithoutPlainText
+ - kms:DescribeKey
+ resource: '*'
+ - effect: Allow
+ action:
+ - kms:RevokeGrant
+ - kms:CreateGrant
+ - kms:ListGrants
+ resource: '*'
+ policyCondition:
+ "Bool":
+ "kms:GrantIsForAWSResource": true
+
---
apiVersion: cloudcredential.openshift.io/v1
kind: CredentialsRequest
