Uploaded image for project: 'OpenShift Bugs'
  1. OpenShift Bugs
  2. OCPBUGS-26036

[AWS] iam:TagInstanceProfile permission is required for ipi install

    XMLWordPrintable

Details

    • No
    • False
    • Hide

      None

      Show
      None
    • Hide
      What: Since the introduction of instance profile tagging, the iam:TagInstanceProfile permission is now required.
      Fix: add permission to the set of required permissions so it's validate before the cluster install.
      Show
      What: Since the introduction of instance profile tagging, the iam:TagInstanceProfile permission is now required. Fix: add permission to the set of required permissions so it's validate before the cluster install.
    • Bug Fix
    • In Progress

    Description

      This is a clone of issue OCPBUGS-25440. The following is the description of the original issue:

      Description of problem:

      iam:TagInstanceProfile is not listed in official document [1], IPI install would fail if iam:TagInstanceProfile permission is missing
      
      level=error msg=Error: creating IAM Instance Profile (ci-op-4hw2rz1v-49c30-zt9vx-worker-profile): AccessDenied: User: arn:aws:iam::301721915996:user/ci-op-4hw2rz1v-49c30-minimal-perm is not authorized to perform: iam:TagInstanceProfile on resource: arn:aws:iam::301721915996:instance-profile/ci-op-4hw2rz1v-49c30-zt9vx-worker-profile because no identity-based policy allows the iam:TagInstanceProfile action
      level=error msg=    status code: 403, request id: bb0641f5-d01c-4538-b333-261a804ddb59
      
      [1] https://docs.openshift.com/container-platform/4.14/installing/installing_aws/installing-aws-account.html#installation-aws-permissions_installing-aws-account
      
          

      Version-Release number of selected component (if applicable):

      4.15.0-0.nightly-2023-12-14-115151
          

      How reproducible:

      Always
          

      Steps to Reproduce:

          1. install a common IPI cluster with minimal permission provided in official document
          2.
          3.
          

      Actual results:

      Install failed.
          

      Expected results:

      
          

      Additional info:

      install does a precheck for iam:TagInstanceProfile
          

      Attachments

        Issue Links

          Activity

            People

              Unassigned Unassigned
              openshift-crt-jira-prow OpenShift Prow Bot
              Yunfei Jiang Yunfei Jiang
              Votes:
              0 Vote for this issue
              Watchers:
              6 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: