Bug 1729021

Summary:	User cannot be created because of missing permission boundary
Product:	OpenShift Container Platform	Reporter:	Florin Peter <florin-alexandru.peter>
Component:	Cloud Credential Operator	Assignee:	Devan Goodwin <dgoodwin>
Status:	CLOSED ERRATA	QA Contact:	Oleg Nesterov <olnester>
Severity:	urgent	Docs Contact:
Priority:	urgent
Version:	4.1.z	CC:	dgoodwin, olnester, sgaikwad
Target Milestone:	---
Target Release:	4.2.0
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:
Clones:	1747165 (view as bug list)		Environment:
Last Closed:	2019-10-16 06:33:27 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1747165

Description Florin Peter 2019-07-11 08:23:05 UTC

Description of problem:
Our IAM root user has a permission boundary set. This means, every IAM user created by that root user has to have the permission boundary set.

We experienced failure in the installation of Openshift 4 on AWS because the user object to be created fails to pull the permission boundary of the provided user that is used to do the installation.

Version-Release number of selected component (if applicable):
4.1.4

How reproducible:
create a AWS user with permission boundary that only allows the user to create a user of the permission boundary is set.

Steps to Reproduce:
1.
2.
3.

Actual results:


Expected results:


Additional info:

Comment 4 Devan Goodwin 2019-08-30 13:52:26 UTC

Docs for QE on this AWS functionality: https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_boundaries.html

Comment 6 Florin Peter 2019-09-03 18:33:02 UTC

Hey Oleg, 
what Info do you need?

Comment 7 Oleg Nesterov 2019-09-03 19:05:21 UTC

@Florin Peter , I've created a new user in AWS and in order to test it I need to know what policy should be attached and what boundary permissions should be set for this user? And after that I am going to create a new cluster using credentials of this user.

Comment 8 Florin Peter 2019-09-03 19:41:54 UTC

Our AWS account is management by another department but I will try to get you something that may can help you to test this.
We already tested 4.2.0-0.nightly-2019-08-27-072819 and I can confirm that the permission boundary is working correctly.

Comment 9 Oleg Nesterov 2019-09-03 19:58:08 UTC

oh, that is great. Anyway, if it is not so difficult , please try to get the info about configuration of aws account ). It will help us to understand clearly your scenarios and test it best way.
Thank you

Comment 10 Oleg Nesterov 2019-09-05 12:44:57 UTC

Verified on 4.2.0-0.nightly-2019-09-04-142146

Comment 11 errata-xmlrpc 2019-10-16 06:33:27 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2019:2922