翻訳は機械翻訳により提供されています。提供された翻訳内容と英語版の間で齟齬、不一致または矛盾がある場合、英語版が優先します。
ROSAKarpenterControllerPolicy
説明: ROSA Karpenter コントローラーが Red Hat OpenShift Service on AWS (ROSA) ホストコントロールプレーンクラスターの EC2 インスタンスを動的にプロビジョニングおよび管理するためのアクセス許可を提供します。これには、EC2 フリートとインスタンスのライフサイクル管理、インスタンスの料金クエリ、カスタマーマネージドキーによる EBS ボリューム暗号化の KMS オペレーション、IAM インスタンスプロファイル管理が含まれます。
ROSAKarpenterControllerPolicy は AWS マネージドポリシーです。
このポリシーを使用すると
ユーザー、グループおよびロールに ROSAKarpenterControllerPolicy をアタッチできます。
ポリシーの詳細
-
タイプ: サービスロールポリシー
-
作成日時: 2026 年 7 月 27 日 16:42 UTC
-
編集日時: 2026 年 7 月 27 日 16:42 UTC
-
ARN:
arn:aws:iam::aws:policy/service-role/ROSAKarpenterControllerPolicy
ポリシーのバージョン
ポリシーのバージョン: v1 (デフォルト)
ポリシーのデフォルトバージョンは、ポリシーのアクセス許可を定義するバージョンです。ポリシーを持つユーザーまたはロールが AWS リソースへのアクセスをリクエストすると、 はポリシーのデフォルトバージョン AWS をチェックして、リクエストを許可するかどうかを決定します。
JSON ポリシードキュメント
{ "Version" : "2012-10-17", "Statement" : [ { "Sid" : "ReadPermissions", "Effect" : "Allow", "Action" : [ "ec2:DescribeAvailabilityZones", "ec2:DescribeCapacityReservations", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeInstanceTypeOfferings", "ec2:DescribeInstanceTypes", "ec2:DescribeLaunchTemplates", "ec2:DescribeSecurityGroups", "ec2:DescribeSnapshots", "ec2:DescribeSpotPriceHistory", "ec2:DescribeSubnets", "ec2:DescribeVpcs" ], "Resource" : "*" }, { "Sid" : "PricingReadActions", "Effect" : "Allow", "Action" : [ "pricing:GetProducts" ], "Resource" : "*" }, { "Sid" : "DescribeKMSKeysForEBSVolumeEncryption", "Effect" : "Allow", "Action" : "kms:DescribeKey", "Resource" : "arn:aws:kms:*:*:key/*", "Condition" : { "StringEquals" : { "aws:ResourceTag/red-hat" : "true" }, "StringLike" : { "kms:ViaService" : "ec2.*.amazonaws.com" } } }, { "Sid" : "CryptoOpsForEBSVolumeEncryption", "Effect" : "Allow", "Action" : [ "kms:Decrypt", "kms:ReEncryptFrom", "kms:ReEncryptTo", "kms:GenerateDataKeyWithoutPlaintext" ], "Resource" : "arn:aws:kms:*:*:key/*", "Condition" : { "StringEquals" : { "aws:ResourceTag/red-hat" : "true" }, "StringLike" : { "kms:ViaService" : "ec2.*.amazonaws.com" }, "ForAllValues:StringEquals" : { "kms:EncryptionContextKeys" : [ "aws:ebs:id" ] } } }, { "Sid" : "CreateGrantForEBSVolumeEncryption", "Effect" : "Allow", "Action" : "kms:CreateGrant", "Resource" : "arn:aws:kms:*:*:key/*", "Condition" : { "Bool" : { "kms:GrantIsForAWSResource" : true }, "StringLike" : { "kms:ViaService" : "ec2.*.amazonaws.com" }, "StringEquals" : { "kms:GrantConstraintType" : "EncryptionContextSubset" }, "ForAllValues:StringEquals" : { "kms:GrantOperations" : [ "Decrypt", "GenerateDataKeyWithoutPlaintext", "ReEncryptFrom", "ReEncryptTo" ], "kms:EncryptionContextKeys" : [ "aws:ebs:id" ] } } }, { "Sid" : "CreateEC2Resources", "Effect" : "Allow", "Action" : [ "ec2:RunInstances", "ec2:CreateFleet" ], "Resource" : [ "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:capacity-reservation/*" ] }, { "Sid" : "CreateEC2ResourcesWithApprovedAMIs", "Effect" : "Allow", "Action" : [ "ec2:RunInstances", "ec2:CreateFleet" ], "Resource" : "arn:aws:ec2:*::image/*", "Condition" : { "StringEquals" : { "ec2:Owner" : [ "531415883065", "251351625822", "210686502322" ] } } }, { "Sid" : "CreateEC2ResourcesWithTags", "Effect" : "Allow", "Action" : [ "ec2:RunInstances", "ec2:CreateFleet", "ec2:CreateLaunchTemplate" ], "Resource" : [ "arn:aws:ec2:*:*:fleet/*", "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:launch-template/*", "arn:aws:ec2:*:*:spot-instances-request/*" ], "Condition" : { "StringEquals" : { "aws:RequestTag/red-hat-managed" : "true" } } }, { "Sid" : "CreateEC2ResourcesLaunchTemplate", "Effect" : "Allow", "Action" : [ "ec2:RunInstances", "ec2:CreateFleet" ], "Resource" : "arn:aws:ec2:*:*:launch-template/*", "Condition" : { "StringEquals" : { "aws:ResourceTag/red-hat-managed" : "true" } } }, { "Sid" : "CreateTagsOnResources", "Effect" : "Allow", "Action" : [ "ec2:CreateTags" ], "Resource" : [ "arn:aws:ec2:*:*:fleet/*", "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:launch-template/*", "arn:aws:ec2:*:*:spot-instances-request/*" ], "Condition" : { "StringEquals" : { "ec2:CreateAction" : [ "RunInstances", "CreateFleet", "CreateLaunchTemplate" ], "aws:RequestTag/red-hat-managed" : "true" } } }, { "Sid" : "ManageTagsOnManagedResources", "Effect" : "Allow", "Action" : [ "ec2:CreateTags" ], "Resource" : "arn:aws:ec2:*:*:instance/*", "Condition" : { "StringEquals" : { "aws:ResourceTag/red-hat-managed" : "true" } } }, { "Sid" : "TerminateManagedResources", "Effect" : "Allow", "Action" : [ "ec2:TerminateInstances", "ec2:DeleteLaunchTemplate" ], "Resource" : [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:launch-template/*" ], "Condition" : { "StringEquals" : { "aws:ResourceTag/red-hat-managed" : "true" } } }, { "Sid" : "PassInstanceRole", "Effect" : "Allow", "Action" : [ "iam:PassRole" ], "Resource" : "arn:aws:iam::*:role/*-ROSA-Worker-Role", "Condition" : { "StringEquals" : { "iam:PassedToService" : [ "ec2.amazonaws.com" ] } } }, { "Sid" : "ManageInstanceProfiles", "Effect" : "Allow", "Action" : [ "iam:AddRoleToInstanceProfile", "iam:RemoveRoleFromInstanceProfile", "iam:DeleteInstanceProfile" ], "Resource" : [ "arn:aws:iam::*:instance-profile/rosa-service-managed-*" ] }, { "Sid" : "CreateInstanceProfiles", "Effect" : "Allow", "Action" : [ "iam:CreateInstanceProfile", "iam:TagInstanceProfile" ], "Resource" : [ "arn:aws:iam::*:instance-profile/rosa-service-managed-*" ], "Condition" : { "StringEquals" : { "aws:RequestTag/red-hat-managed" : "true" } } }, { "Sid" : "ReadInstanceProfiles", "Effect" : "Allow", "Action" : [ "iam:GetInstanceProfile", "iam:ListInstanceProfiles" ], "Resource" : "*" } ] }
詳細情報
