Skip to content

feat(aws): activate IAM resources for the EKS CI identity #2564

Closed

Description

@devantler

🤖 Generated by the Daily AI Engineer

Problem

Platform#2326 cannot declare the GitHub OIDC provider and EKS CI role yet: the Upbound AWS provider uses SafeStart, so the two required namespaced IAM managed-resource definitions are inactive and the aws tenant ServiceAccount has no permission to apply them.

Proposed direction

Activate only OpenIDConnectProvider and Role for provider-aws-iam v2.6.1, then grant the aws ServiceAccount namespace-local CRUD for exactly those resources. The role can carry its least-privilege permissions as a managed inline policy, avoiding separate Policy and attachment CRDs. Keep the tenant artifact empty in this slice, so merging creates no AWS resources; the follow-up identity manifests remain the activation checkpoint.

Acceptance criteria

  • A dedicated AWS ManagedResourceActivationPolicy activates exactly the two namespaced IAM MRDs needed by platform#2326.
  • A namespaced Role and RoleBinding grant the aws ServiceAccount only those two resource kinds and standard reconciliation verbs.
  • Both local and prod overlays pass static validation; no AWS managed resource is added.
  • Comments make the dark/no-AWS-side-effect sequencing explicit.

Part of #2326.

Rough size: S.

Activity

  1. coderabbitai commented on Jul 10, 2026

    @coderabbitai
    Contributor
    🔗 Related PRs

    #2328 - feat: install AWS Crossplane provider (IAM family) foundation [merged]
    #2345 - fix(openbao): grant actual-budget the missing vault ACL paths [merged]
    #2377 - feat(vault-config): seed the AWS bootstrap credential path (placeholder + policy + tenant role) [merged]
    #2412 - feat(aws): aws tenant credential plumbing (SecretStore + ProviderConfig) [merged]
    #2481 - feat(tenants): wire the aws tenant to its signed OCI artifact [merged]


    📝 Issue Planner

    Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.

    • Create Plan

    🧪 Issue enrichment is currently in open beta.

    You can configure auto-planning by selecting labels in the issue_enrichment configuration.

    To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

    issue_enrichment:
      auto_enrich:
        enabled: false

    💬 Have feedback or questions? Drop into our discord!

  2. moved this from 👀 In Review to ✅ Done in 🌊 Project Boardon Jul 10, 2026
  3. botantler-1 commented on Jul 10, 2026

    @botantler-1
    Contributor

    🎉 This issue has been resolved in version 1.110.0 🎉

    The release is available on GitHub release

    Your semantic-release bot 📦🚀

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Fields

    Priority

    None yet

    Projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions