What are the necessary IAM permissions?

[Infinoid]

Hi,

I'm setting up a pod role so that this provider has permissions to make AWS API calls. I imagine it'll need at least ec2:RunInstances, right? Is there an example IAM policy document, or a list of the necessary permissions documented somewhere? I'm struggling to find it.

Does this ClientInterface definition cover everything?

Thanks!

[Infinoid]

I used the ClientInterface definition linked above as a starting point. I found I also had to add ec2:CreateTags. With that, it looks like it's able to create and remove runners.

So that's:

{
    "Statement": [
        {
            "Action": [
                "ec2:StartInstances",
                "ec2:StopInstances",
                "ec2:DescribeInstances",
                "ec2:DescribeImages",
                "ec2:TerminateInstances",
                "ec2:RunInstances",
                "ec2:CreateTags"
            ],
            "Effect": "Allow",
            "Resource": "*"
        }
    ],
    "Version": "2012-10-17"
}

Does that look right?

(updated for #83.)

[gabriel-samfira]

Yup. The role looks right. I will add an example to the docs soon

[Infinoid]

Great, thanks.