本文属于机器翻译版本。若本译文内容与英语原文存在差异，则一律以英文原文为准。
ROSAKarpenterControllerPolicy
描述：为 ROSA Karpenter 控制器提供在 AWS (ROSA) 托管控制平面集群上动态配置和管理红帽 OpenShift 服务的 EC2 实例的权限。这包括 EC2 队列和实例生命周期管理、实例定价查询、使用客户管理密钥进行 EBS 卷加密的 KMS 操作以及 IAM 实例配置文件管理。
ROSAKarpenterControllerPolicy 是一项 AWS 托管式策略。
使用此策略
您可以将 ROSAKarpenterControllerPolicy 附加到您的用户、组和角色。
策略详细信息
-
类型：服务角色策略
-
创建时间：世界标准时间 2026 年 7 月 27 日 16:42
-
编辑时间：世界标准时间 2026 年 7 月 27 日 16:42
-
ARN:
arn:aws:iam::aws:policy/service-role/ROSAKarpenterControllerPolicy
策略版本
策略版本：v1（默认）
此策略的默认版本是定义策略权限的版本。当具有该策略的用户或角色请求访问 AWS 资源时， AWS 会检查策略的默认版本以确定是否允许该请求。
JSON 策略文档
{ "Version" : "2012-10-17", "Statement" : [ { "Sid" : "ReadPermissions", "Effect" : "Allow", "Action" : [ "ec2:DescribeAvailabilityZones", "ec2:DescribeCapacityReservations", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeInstanceTypeOfferings", "ec2:DescribeInstanceTypes", "ec2:DescribeLaunchTemplates", "ec2:DescribeSecurityGroups", "ec2:DescribeSnapshots", "ec2:DescribeSpotPriceHistory", "ec2:DescribeSubnets", "ec2:DescribeVpcs" ], "Resource" : "*" }, { "Sid" : "PricingReadActions", "Effect" : "Allow", "Action" : [ "pricing:GetProducts" ], "Resource" : "*" }, { "Sid" : "DescribeKMSKeysForEBSVolumeEncryption", "Effect" : "Allow", "Action" : "kms:DescribeKey", "Resource" : "arn:aws:kms:*:*:key/*", "Condition" : { "StringEquals" : { "aws:ResourceTag/red-hat" : "true" }, "StringLike" : { "kms:ViaService" : "ec2.*.amazonaws.com" } } }, { "Sid" : "CryptoOpsForEBSVolumeEncryption", "Effect" : "Allow", "Action" : [ "kms:Decrypt", "kms:ReEncryptFrom", "kms:ReEncryptTo", "kms:GenerateDataKeyWithoutPlaintext" ], "Resource" : "arn:aws:kms:*:*:key/*", "Condition" : { "StringEquals" : { "aws:ResourceTag/red-hat" : "true" }, "StringLike" : { "kms:ViaService" : "ec2.*.amazonaws.com" }, "ForAllValues:StringEquals" : { "kms:EncryptionContextKeys" : [ "aws:ebs:id" ] } } }, { "Sid" : "CreateGrantForEBSVolumeEncryption", "Effect" : "Allow", "Action" : "kms:CreateGrant", "Resource" : "arn:aws:kms:*:*:key/*", "Condition" : { "Bool" : { "kms:GrantIsForAWSResource" : true }, "StringLike" : { "kms:ViaService" : "ec2.*.amazonaws.com" }, "StringEquals" : { "kms:GrantConstraintType" : "EncryptionContextSubset" }, "ForAllValues:StringEquals" : { "kms:GrantOperations" : [ "Decrypt", "GenerateDataKeyWithoutPlaintext", "ReEncryptFrom", "ReEncryptTo" ], "kms:EncryptionContextKeys" : [ "aws:ebs:id" ] } } }, { "Sid" : "CreateEC2Resources", "Effect" : "Allow", "Action" : [ "ec2:RunInstances", "ec2:CreateFleet" ], "Resource" : [ "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:capacity-reservation/*" ] }, { "Sid" : "CreateEC2ResourcesWithApprovedAMIs", "Effect" : "Allow", "Action" : [ "ec2:RunInstances", "ec2:CreateFleet" ], "Resource" : "arn:aws:ec2:*::image/*", "Condition" : { "StringEquals" : { "ec2:Owner" : [ "531415883065", "251351625822", "210686502322" ] } } }, { "Sid" : "CreateEC2ResourcesWithTags", "Effect" : "Allow", "Action" : [ "ec2:RunInstances", "ec2:CreateFleet", "ec2:CreateLaunchTemplate" ], "Resource" : [ "arn:aws:ec2:*:*:fleet/*", "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:launch-template/*", "arn:aws:ec2:*:*:spot-instances-request/*" ], "Condition" : { "StringEquals" : { "aws:RequestTag/red-hat-managed" : "true" } } }, { "Sid" : "CreateEC2ResourcesLaunchTemplate", "Effect" : "Allow", "Action" : [ "ec2:RunInstances", "ec2:CreateFleet" ], "Resource" : "arn:aws:ec2:*:*:launch-template/*", "Condition" : { "StringEquals" : { "aws:ResourceTag/red-hat-managed" : "true" } } }, { "Sid" : "CreateTagsOnResources", "Effect" : "Allow", "Action" : [ "ec2:CreateTags" ], "Resource" : [ "arn:aws:ec2:*:*:fleet/*", "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:launch-template/*", "arn:aws:ec2:*:*:spot-instances-request/*" ], "Condition" : { "StringEquals" : { "ec2:CreateAction" : [ "RunInstances", "CreateFleet", "CreateLaunchTemplate" ], "aws:RequestTag/red-hat-managed" : "true" } } }, { "Sid" : "ManageTagsOnManagedResources", "Effect" : "Allow", "Action" : [ "ec2:CreateTags" ], "Resource" : "arn:aws:ec2:*:*:instance/*", "Condition" : { "StringEquals" : { "aws:ResourceTag/red-hat-managed" : "true" } } }, { "Sid" : "TerminateManagedResources", "Effect" : "Allow", "Action" : [ "ec2:TerminateInstances", "ec2:DeleteLaunchTemplate" ], "Resource" : [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:launch-template/*" ], "Condition" : { "StringEquals" : { "aws:ResourceTag/red-hat-managed" : "true" } } }, { "Sid" : "PassInstanceRole", "Effect" : "Allow", "Action" : [ "iam:PassRole" ], "Resource" : "arn:aws:iam::*:role/*-ROSA-Worker-Role", "Condition" : { "StringEquals" : { "iam:PassedToService" : [ "ec2.amazonaws.com" ] } } }, { "Sid" : "ManageInstanceProfiles", "Effect" : "Allow", "Action" : [ "iam:AddRoleToInstanceProfile", "iam:RemoveRoleFromInstanceProfile", "iam:DeleteInstanceProfile" ], "Resource" : [ "arn:aws:iam::*:instance-profile/rosa-service-managed-*" ] }, { "Sid" : "CreateInstanceProfiles", "Effect" : "Allow", "Action" : [ "iam:CreateInstanceProfile", "iam:TagInstanceProfile" ], "Resource" : [ "arn:aws:iam::*:instance-profile/rosa-service-managed-*" ], "Condition" : { "StringEquals" : { "aws:RequestTag/red-hat-managed" : "true" } } }, { "Sid" : "ReadInstanceProfiles", "Effect" : "Allow", "Action" : [ "iam:GetInstanceProfile", "iam:ListInstanceProfiles" ], "Resource" : "*" } ] }
了解详情
