CA - AWS - Rework IAM Docs/Snippets

[gjtempleton]

Which component this PR applies to?

Cluster Autoscaler - AWS cloud provider docs.

What type of PR is this?

/kind documentation

What this PR does / why we need it:

Follows up on a number of PRs we've seen from users in the recent past being confused by the existing IAM docs for using the CA in AWS (e.g. #4586 and #4465) as well as strengthening recommendations that users restrict the IAM roles provided via Resources of Conditionals as suggested by #4403.

Does this in part by explicitly providing two IAM policies rather than one minimal set with recommended additions hidden in a later sentence and making explicit the options blocked off by the use of the more limited policy. It also moves the recommendation to lock down IAM permissions to before the policy snippets rather than after to increase the likelihood of users reading it.

Which issue(s) this PR fixes:

Fixes #

Special notes for your reviewer:

Does this PR introduce a user-facing change?

NONE

Additional documentation e.g., KEPs (Kubernetes Enhancement Proposals), usage docs, etc.:

[gjtempleton]

@RafaelMoreira1180778 and @raphael1021 as authors of some of the original PRs, would appreciate your feedback on whether you think this improves the docs.

@trumant Do you think this improves things on the RBAC recommendation front? I've moved the restrictions block higher up to before the snippets and reused some of your reworking of the policies.

[raphaelIl]

It's a readable docs. Thx :)

[gjtempleton]

/assign @jaypipes

[RafaelMoreira1180778]

Hi, sorry for answering so late, it's a great improvement, I had to change the permissions to those on my CA setup, thanks for changing the docs!

[gjtempleton]

/hold
Need to rework the IAM snippet in the OIDC example as well as here.

[gjtempleton]

/hold cancel

[jaypipes]

All very good cleanups, @gjtempleton thank you!

[jaypipes]

👍

[jaypipes]

nice catch.

[jaypipes]

/lgtm

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: gjtempleton, jaypipes, RafaelMoreira1180778, raphael1021, trumant

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• cluster-autoscaler/cloudprovider/aws/OWNERS [gjtempleton,jaypipes]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment