You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
feat(aws): activate IAM resources for the EKS CI identity #2564
Platform#2326 cannot declare the GitHub OIDC provider and EKS CI role yet: the Upbound AWS provider uses SafeStart, so the two required namespaced IAM managed-resource definitions are inactive and the aws tenant ServiceAccount has no permission to apply them.
Proposed direction
Activate only OpenIDConnectProvider and Role for provider-aws-iam v2.6.1, then grant the aws ServiceAccount namespace-local CRUD for exactly those resources. The role can carry its least-privilege permissions as a managed inline policy, avoiding separate Policy and attachment CRDs. Keep the tenant artifact empty in this slice, so merging creates no AWS resources; the follow-up identity manifests remain the activation checkpoint.
Acceptance criteria
A dedicated AWS ManagedResourceActivationPolicy activates exactly the two namespaced IAM MRDs needed by platform#2326.
A namespaced Role and RoleBinding grant the aws ServiceAccount only those two resource kinds and standard reconciliation verbs.
Both local and prod overlays pass static validation; no AWS managed resource is added.
Comments make the dark/no-AWS-side-effect sequencing explicit.
#2328 - feat: install AWS Crossplane provider (IAM family) foundation [merged] #2345 - fix(openbao): grant actual-budget the missing vault ACL paths [merged] #2377 - feat(vault-config): seed the AWS bootstrap credential path (placeholder + policy + tenant role) [merged] #2412 - feat(aws): aws tenant credential plumbing (SecretStore + ProviderConfig) [merged] #2481 - feat(tenants): wire the aws tenant to its signed OCI artifact [merged]
📝 Issue Planner
Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.
Create Plan
🧪 Issue enrichment is currently in open beta.
You can configure auto-planning by selecting labels in the issue_enrichment configuration.
To disable automatic issue enrichment, add the following to your .coderabbit.yaml:
issue_enrichment:
auto_enrich:
enabled: false
💬 Have feedback or questions? Drop into our discord!
Activity
coderabbitai commentedon Jul 10, 2026
🔗 Related PRs
#2328 - feat: install AWS Crossplane provider (IAM family) foundation [merged]
#2345 - fix(openbao): grant actual-budget the missing vault ACL paths [merged]
#2377 - feat(vault-config): seed the AWS bootstrap credential path (placeholder + policy + tenant role) [merged]
#2412 - feat(aws): aws tenant credential plumbing (SecretStore + ProviderConfig) [merged]
#2481 - feat(tenants): wire the aws tenant to its signed OCI artifact [merged]
📝 Issue Planner
Check the box below or use the
@coderabbitai plancommand to generate an implementation plan and prompts that you can use with your favorite coding assistant.🧪 Issue enrichment is currently in open beta.
You can configure auto-planning by selecting labels in the issue_enrichment configuration.
To disable automatic issue enrichment, add the following to your
.coderabbit.yaml:💬 Have feedback or questions? Drop into our discord!
botantler-1 commentedon Jul 10, 2026
🎉 This issue has been resolved in version 1.110.0 🎉
The release is available on GitHub release
Your semantic-release bot 📦🚀