Add latest changes to AWS Load Balancer Controller IAM Policy (#8316)

Author: MartinEmrich

pkg/cfn/builder/iam_test.go

@@ -497,17 +497,21 @@ const expectedAWSLoadBalancerControllerPolicyDocument = `{
         "ec2:DescribeTags",
         "ec2:GetCoipPoolUsage",
         "ec2:DescribeCoipPools",
+        "ec2:GetSecurityGroupsForVpc",
+        "ec2:DescribeIpamPools",
         "elasticloadbalancing:DescribeLoadBalancers",
         "elasticloadbalancing:DescribeLoadBalancerAttributes",
         "elasticloadbalancing:DescribeListeners",
-        "elasticloadbalancing:DescribeListenerAttributes",
         "elasticloadbalancing:DescribeListenerCertificates",
         "elasticloadbalancing:DescribeSSLPolicies",
         "elasticloadbalancing:DescribeRules",
         "elasticloadbalancing:DescribeTargetGroups",
         "elasticloadbalancing:DescribeTargetGroupAttributes",
         "elasticloadbalancing:DescribeTargetHealth",
-        "elasticloadbalancing:DescribeTags"
+        "elasticloadbalancing:DescribeTags",
+        "elasticloadbalancing:DescribeTrustStores",
+        "elasticloadbalancing:DescribeListenerAttributes",
+        "elasticloadbalancing:DescribeCapacityReservation"
       ],
       "Effect": "Allow",
       "Resource": "*"
@@ -667,15 +671,17 @@ const expectedAWSLoadBalancerControllerPolicyDocument = `{
     },
     {
       "Action": [
-        "elasticloadbalancing:ModifyListenerAttributes",
         "elasticloadbalancing:ModifyLoadBalancerAttributes",
         "elasticloadbalancing:SetIpAddressType",
         "elasticloadbalancing:SetSecurityGroups",
         "elasticloadbalancing:SetSubnets",
         "elasticloadbalancing:DeleteLoadBalancer",
         "elasticloadbalancing:ModifyTargetGroup",
         "elasticloadbalancing:ModifyTargetGroupAttributes",
-        "elasticloadbalancing:DeleteTargetGroup"
+        "elasticloadbalancing:DeleteTargetGroup",
+        "elasticloadbalancing:ModifyListenerAttributes",
+        "elasticloadbalancing:ModifyCapacityReservation",
+        "elasticloadbalancing:ModifyIpPools"
       ],
       "Condition": {
         "Null": {
@@ -729,7 +735,8 @@ const expectedAWSLoadBalancerControllerPolicyDocument = `{
         "elasticloadbalancing:ModifyListener",
         "elasticloadbalancing:AddListenerCertificates",
         "elasticloadbalancing:RemoveListenerCertificates",
-        "elasticloadbalancing:ModifyRule"
+        "elasticloadbalancing:ModifyRule",
+        "elasticloadbalancing:SetRulePriorities"
       ],
       "Effect": "Allow",
       "Resource": "*"

pkg/cfn/builder/statement.go

@@ -39,17 +39,21 @@ func loadBalancerControllerStatements() []cft.MapOfInterfaces {
 				"ec2:DescribeTags",
 				"ec2:GetCoipPoolUsage",
 				"ec2:DescribeCoipPools",
+				"ec2:GetSecurityGroupsForVpc",
+				"ec2:DescribeIpamPools",
 				"elasticloadbalancing:DescribeLoadBalancers",
 				"elasticloadbalancing:DescribeLoadBalancerAttributes",
 				"elasticloadbalancing:DescribeListeners",
-				"elasticloadbalancing:DescribeListenerAttributes",
 				"elasticloadbalancing:DescribeListenerCertificates",
 				"elasticloadbalancing:DescribeSSLPolicies",
 				"elasticloadbalancing:DescribeRules",
 				"elasticloadbalancing:DescribeTargetGroups",
 				"elasticloadbalancing:DescribeTargetGroupAttributes",
 				"elasticloadbalancing:DescribeTargetHealth",
 				"elasticloadbalancing:DescribeTags",
+				"elasticloadbalancing:DescribeTrustStores",
+				"elasticloadbalancing:DescribeListenerAttributes",
+				"elasticloadbalancing:DescribeCapacityReservation",
 			},
 			"Resource": resourceAll,
 		},
@@ -191,7 +195,6 @@ func loadBalancerControllerStatements() []cft.MapOfInterfaces {
 		{
 			"Effect": effectAllow,
 			"Action": []string{
-				"elasticloadbalancing:ModifyListenerAttributes",
 				"elasticloadbalancing:ModifyLoadBalancerAttributes",
 				"elasticloadbalancing:SetIpAddressType",
 				"elasticloadbalancing:SetSecurityGroups",
@@ -200,6 +203,9 @@ func loadBalancerControllerStatements() []cft.MapOfInterfaces {
 				"elasticloadbalancing:ModifyTargetGroup",
 				"elasticloadbalancing:ModifyTargetGroupAttributes",
 				"elasticloadbalancing:DeleteTargetGroup",
+				"elasticloadbalancing:ModifyListenerAttributes",
+				"elasticloadbalancing:ModifyCapacityReservation",
+				"elasticloadbalancing:ModifyIpPools",
 			},
 			"Resource": resourceAll,
 			"Condition": map[string]interface{}{
@@ -246,6 +252,7 @@ func loadBalancerControllerStatements() []cft.MapOfInterfaces {
 				"elasticloadbalancing:AddListenerCertificates",
 				"elasticloadbalancing:RemoveListenerCertificates",
 				"elasticloadbalancing:ModifyRule",
+				"elasticloadbalancing:SetRulePriorities",
 			},
 			"Resource": resourceAll,
 		},