AWS rosa: ROSAControlPlaneOperatorPolicy tag management update
Summary
Added explicit permissions for tagging Red Hat-managed security groups with safeguards to prevent removal of critical 'red-hat-managed' tag
Security assessment
Preventing removal of 'red-hat-managed' tag ensures proper identification of managed resources, reducing risk of accidental misconfiguration or unauthorized modification
Evidence
+ * Add and remove tags on Red Hat-managed security groups: The Control Plane Operator can tag and untag Red Hat-managed security groups for proper resource lifecycle management and cleanup. The policy prevents the operator from removing the `red-hat-managed` tag, which identifies these resources as Red Hat-managed.
Diff
diff --git a/rosa/latest/userguide/security-iam-awsmanpol.md b/rosa/latest/userguide/security-iam-awsmanpol.md index c0ae1b3a1..86476e571 100644 --- a//rosa/latest/userguide/security-iam-awsmanpol.md +++ b//rosa/latest/userguide/security-iam-awsmanpol.md @@ -312 +312 @@ This policy includes the following permissions that allow the Control Plane Oper - * Added tags to RedHatManagedSecurityGroups: Allows the Control Plane Operator to tag Red Hat-managed security groups after creation. This is required for proper resource lifecycle management and cleanup of security groups associated with ROSA with HCP clusters. + * Add and remove tags on Red Hat-managed security groups: The Control Plane Operator can tag and untag Red Hat-managed security groups for proper resource lifecycle management and cleanup. The policy prevents the operator from removing the `red-hat-managed` tag, which identifies these resources as Red Hat-managed. @@ -314 +314 @@ This policy includes the following permissions that allow the Control Plane Oper - * Added security-group/* to ManageVPCEndpointWithCondition: Fixes VPCE reconciliation failures during cluster upgrades. The operator needs permission to modify VPC endpoints that reference security groups. + * Manage VPC endpoints that reference security groups: The Control Plane Operator can modify VPC endpoints that reference security groups. VPC endpoint reconciliation during cluster upgrades requires this permission. @@ -351,0 +352 @@ Change | Description | Date +ROSAControlPlaneOperatorPolicy — Policy updated | AWS updated ROSAControlPlaneOperatorPolicy. With this update, the Control Plane Operator can add and remove tags on Red Hat-managed security groups (`ec2:DeleteTags`). A safeguard prevents the operator from removing the `red-hat-managed` tag itself. To learn more, see AWS managed policy: ROSAControlPlaneOperatorPolicy. | July 28, 2026