Las traducciones son generadas a través de traducción automática. En caso de conflicto entre la traducción y la version original de inglés, prevalecerá la version en inglés.
ROSAKarpenterControllerPolicy
Descripción: Proporciona permisos para que el controlador ROSA Karpenter aprovisione y gestione dinámicamente instancias EC2 para clústeres de planos de control alojados en Red Hat OpenShift Service on AWS (ROSA). Esto incluye la administración del ciclo de vida de las instancias y flotas de EC2, las consultas sobre los precios de las instancias, las operaciones de KMS para el cifrado de volúmenes de EBS con claves administradas por el cliente y la administración de perfiles de instancias de IAM.
ROSAKarpenterControllerPolicy es una política administrada de AWS.
Uso de la política
Puede asociar ROSAKarpenterControllerPolicy a los usuarios, grupos y roles.
Información de la política
-
Tipo: política de rol de servicio
-
Hora de creación: 27 de julio de 2026, 16:42 UTC
-
Hora editada: 27 de julio de 2026, 16:42 UTC
-
ARN:
arn:aws:iam::aws:policy/service-role/ROSAKarpenterControllerPolicy
Versión de la política
Versión de la política: v1 (predeterminada)
La versión predeterminada de la política define qué permisos tendrá. Cuando un usuario o un rol de la política solicita acceder a un AWS recurso, AWS comprueba la versión predeterminada de la política para determinar si permite la solicitud.
Documento de política JSON
{ "Version" : "2012-10-17", "Statement" : [ { "Sid" : "ReadPermissions", "Effect" : "Allow", "Action" : [ "ec2:DescribeAvailabilityZones", "ec2:DescribeCapacityReservations", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeInstanceTypeOfferings", "ec2:DescribeInstanceTypes", "ec2:DescribeLaunchTemplates", "ec2:DescribeSecurityGroups", "ec2:DescribeSnapshots", "ec2:DescribeSpotPriceHistory", "ec2:DescribeSubnets", "ec2:DescribeVpcs" ], "Resource" : "*" }, { "Sid" : "PricingReadActions", "Effect" : "Allow", "Action" : [ "pricing:GetProducts" ], "Resource" : "*" }, { "Sid" : "DescribeKMSKeysForEBSVolumeEncryption", "Effect" : "Allow", "Action" : "kms:DescribeKey", "Resource" : "arn:aws:kms:*:*:key/*", "Condition" : { "StringEquals" : { "aws:ResourceTag/red-hat" : "true" }, "StringLike" : { "kms:ViaService" : "ec2.*.amazonaws.com" } } }, { "Sid" : "CryptoOpsForEBSVolumeEncryption", "Effect" : "Allow", "Action" : [ "kms:Decrypt", "kms:ReEncryptFrom", "kms:ReEncryptTo", "kms:GenerateDataKeyWithoutPlaintext" ], "Resource" : "arn:aws:kms:*:*:key/*", "Condition" : { "StringEquals" : { "aws:ResourceTag/red-hat" : "true" }, "StringLike" : { "kms:ViaService" : "ec2.*.amazonaws.com" }, "ForAllValues:StringEquals" : { "kms:EncryptionContextKeys" : [ "aws:ebs:id" ] } } }, { "Sid" : "CreateGrantForEBSVolumeEncryption", "Effect" : "Allow", "Action" : "kms:CreateGrant", "Resource" : "arn:aws:kms:*:*:key/*", "Condition" : { "Bool" : { "kms:GrantIsForAWSResource" : true }, "StringLike" : { "kms:ViaService" : "ec2.*.amazonaws.com" }, "StringEquals" : { "kms:GrantConstraintType" : "EncryptionContextSubset" }, "ForAllValues:StringEquals" : { "kms:GrantOperations" : [ "Decrypt", "GenerateDataKeyWithoutPlaintext", "ReEncryptFrom", "ReEncryptTo" ], "kms:EncryptionContextKeys" : [ "aws:ebs:id" ] } } }, { "Sid" : "CreateEC2Resources", "Effect" : "Allow", "Action" : [ "ec2:RunInstances", "ec2:CreateFleet" ], "Resource" : [ "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:capacity-reservation/*" ] }, { "Sid" : "CreateEC2ResourcesWithApprovedAMIs", "Effect" : "Allow", "Action" : [ "ec2:RunInstances", "ec2:CreateFleet" ], "Resource" : "arn:aws:ec2:*::image/*", "Condition" : { "StringEquals" : { "ec2:Owner" : [ "531415883065", "251351625822", "210686502322" ] } } }, { "Sid" : "CreateEC2ResourcesWithTags", "Effect" : "Allow", "Action" : [ "ec2:RunInstances", "ec2:CreateFleet", "ec2:CreateLaunchTemplate" ], "Resource" : [ "arn:aws:ec2:*:*:fleet/*", "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:launch-template/*", "arn:aws:ec2:*:*:spot-instances-request/*" ], "Condition" : { "StringEquals" : { "aws:RequestTag/red-hat-managed" : "true" } } }, { "Sid" : "CreateEC2ResourcesLaunchTemplate", "Effect" : "Allow", "Action" : [ "ec2:RunInstances", "ec2:CreateFleet" ], "Resource" : "arn:aws:ec2:*:*:launch-template/*", "Condition" : { "StringEquals" : { "aws:ResourceTag/red-hat-managed" : "true" } } }, { "Sid" : "CreateTagsOnResources", "Effect" : "Allow", "Action" : [ "ec2:CreateTags" ], "Resource" : [ "arn:aws:ec2:*:*:fleet/*", "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:launch-template/*", "arn:aws:ec2:*:*:spot-instances-request/*" ], "Condition" : { "StringEquals" : { "ec2:CreateAction" : [ "RunInstances", "CreateFleet", "CreateLaunchTemplate" ], "aws:RequestTag/red-hat-managed" : "true" } } }, { "Sid" : "ManageTagsOnManagedResources", "Effect" : "Allow", "Action" : [ "ec2:CreateTags" ], "Resource" : "arn:aws:ec2:*:*:instance/*", "Condition" : { "StringEquals" : { "aws:ResourceTag/red-hat-managed" : "true" } } }, { "Sid" : "TerminateManagedResources", "Effect" : "Allow", "Action" : [ "ec2:TerminateInstances", "ec2:DeleteLaunchTemplate" ], "Resource" : [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:launch-template/*" ], "Condition" : { "StringEquals" : { "aws:ResourceTag/red-hat-managed" : "true" } } }, { "Sid" : "PassInstanceRole", "Effect" : "Allow", "Action" : [ "iam:PassRole" ], "Resource" : "arn:aws:iam::*:role/*-ROSA-Worker-Role", "Condition" : { "StringEquals" : { "iam:PassedToService" : [ "ec2.amazonaws.com" ] } } }, { "Sid" : "ManageInstanceProfiles", "Effect" : "Allow", "Action" : [ "iam:AddRoleToInstanceProfile", "iam:RemoveRoleFromInstanceProfile", "iam:DeleteInstanceProfile" ], "Resource" : [ "arn:aws:iam::*:instance-profile/rosa-service-managed-*" ] }, { "Sid" : "CreateInstanceProfiles", "Effect" : "Allow", "Action" : [ "iam:CreateInstanceProfile", "iam:TagInstanceProfile" ], "Resource" : [ "arn:aws:iam::*:instance-profile/rosa-service-managed-*" ], "Condition" : { "StringEquals" : { "aws:RequestTag/red-hat-managed" : "true" } } }, { "Sid" : "ReadInstanceProfiles", "Effect" : "Allow", "Action" : [ "iam:GetInstanceProfile", "iam:ListInstanceProfiles" ], "Resource" : "*" } ] }
Más información
