User Story:

As a user, I want to be able to:

• use AWS IAM roles that I create without needing to give the iam:TagRole permission

so that I can achieve

• do an IPI AWS install with permissions bounded by tags. If the user has the iam:TagRole permission, then they effectively have all permissions since they can tag other resources.

Acceptance Criteria:

Description of criteria:

• successful IPI AWS install using user-provided master and worker IAM roles and a user that does not have the iam:TagRole permission.

(optional) Out of Scope:

Modifying existing clusters that were installed with BYO IAM roles so that the roles are no longer tagged as shared by the cluster.

Engineering Details:

• Remove the code that adds the shared tag to the BYO IAM roles. https://github.com/openshift/installer/blob/master/pkg/asset/cluster/aws/aws.go#L100

This does not require a design proposal.
This does not require a feature gate.