[release-4.18] OCPBUGS-46046: aws: fix sts:AssumeRole perm requirement

pkg/asset/installconfig/aws/permissions.go

@@ -68,6 +68,9 @@ const (
 	// PermissionDefaultZones is a permission set required when zones are not set in the install-config.
 	PermissionDefaultZones PermissionGroup = "permission-default-zones"
 
+	// PermissionAssumeRole is a permission set required when an IAM role to be assumed is set in the install-config.
+	PermissionAssumeRole PermissionGroup = "permission-assume-role"
+
 	// PermissionMintCreds is a permission set required when minting credentials.
 	PermissionMintCreds PermissionGroup = "permission-mint-creds"
 
@@ -324,6 +327,10 @@ var permissions = map[PermissionGroup][]string{
 		// Needed to filter zones by instance type
 		"ec2:DescribeInstanceTypeOfferings",
 	},
+	PermissionAssumeRole: {
+		// Needed so the installer can use the provided custom IAM role
+		"sts:AssumeRole",
+	},
 	// From: https://github.com/openshift/cloud-credential-operator/blob/master/pkg/aws/utils.go
 	// TODO: export these in CCO so we don't have to duplicate them here.
 	PermissionMintCreds: {
@@ -511,6 +518,10 @@ func RequiredPermissionGroups(ic *types.InstallConfig) []PermissionGroup {
 		permissionGroups = append(permissionGroups, PermissionDefaultZones)
 	}
 
+	if includesAssumeRole(ic) {
+		permissionGroups = append(permissionGroups, PermissionAssumeRole)
+	}
+
 	return permissionGroups
 }
 
@@ -682,3 +693,8 @@ func includesZones(installConfig *types.InstallConfig) bool {
 
 	return len(mpool.Zones) > 0 || len(installConfig.AWS.Subnets) > 0
 }
+
+// includesAssumeRole checks if a custom IAM role is specified in the install-config.
+func includesAssumeRole(installConfig *types.InstallConfig) bool {
+	return len(installConfig.AWS.HostedZoneRole) > 0
+}

pkg/asset/installconfig/aws/permissions_test.go

@@ -807,3 +807,17 @@ func TestIncludesZones(t *testing.T) {
 		assert.Contains(t, requiredPerms, PermissionDefaultZones)
 	})
 }
+
+func TestIncludesAssumeRole(t *testing.T) {
+	t.Run("Should be true when IAM role specified", func(t *testing.T) {
+		ic := validInstallConfig()
+		ic.AWS.HostedZoneRole = "custom-role"
+		requiredPerms := RequiredPermissionGroups(ic)
+		assert.Contains(t, requiredPerms, PermissionAssumeRole)
+	})
+	t.Run("Should be false when IAM role not specified", func(t *testing.T) {
+		ic := validInstallConfig()
+		requiredPerms := RequiredPermissionGroups(ic)
+		assert.NotContains(t, requiredPerms, PermissionAssumeRole)
+	})
+}