Goal:

• As a user I would like to set the minimum IAM permissions required to create an OCP cluster on AWS

Context:

After 4.16, when switching to CAPA as infrastructure provisioner, the permissions changed and tracking the changes across releases could be a challenge. The bug OCPBUGS-35378 describes an assessment request to review the existing permissions.

We are investigating how to do it by parsing events in CloudTrail across releases and deployment variants. This threads describes[1] the initial effort.

Acceptance criteria:

• Make an assessment installing a cluster and parsing the CLoudTrail events, check the outliers (missing and extra permissions) and create a report
• Check if there is any improvement or opportunities to embed in the CI workflow

Additional context and references:

• https://issues.redhat.com/browse/OCPBUGS-35378
• initial experiment: https://redhat-internal.slack.com/archives/C68TNFWA2/p1727094774490479
• step by step: https://github.com/mtulio/mtulio.labs/pull/33/files#diff-01ee0d3ac1978c082dccb1aac5af7b1c4de8e3bfca4429b9649a32a59ff85344