Bug 1729021 - User cannot be created because of missing permission boundary
Summary: User cannot be created because of missing permission boundary
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: OpenShift Container Platform
Classification: Red Hat
Component: Cloud Credential Operator
Version: 4.1.z
Hardware: Unspecified
OS: Unspecified
urgent
urgent
Target Milestone: ---
: 4.2.0
Assignee: Devan Goodwin
QA Contact: Oleg Nesterov
URL:
Whiteboard:
Depends On:
Blocks: 1747165
TreeView+ depends on / blocked
 
Reported: 2019-07-11 08:23 UTC by Florin Peter
Modified: 2019-10-16 06:33 UTC (History)
3 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
: 1747165 (view as bug list)
Environment:
Last Closed: 2019-10-16 06:33:27 UTC
Target Upstream Version:


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Github openshift cloud-credential-operator pull 89 None closed Bug 1729021: utilize the permissionBoundary of the current user if available 2020-01-29 22:03:39 UTC
Red Hat Product Errata RHBA-2019:2922 None None None 2019-10-16 06:33:39 UTC

Description Florin Peter 2019-07-11 08:23:05 UTC
Description of problem:
Our IAM root user has a permission boundary set. This means, every IAM user created by that root user has to have the permission boundary set.

We experienced failure in the installation of Openshift 4 on AWS because the user object to be created fails to pull the permission boundary of the provided user that is used to do the installation.

Version-Release number of selected component (if applicable):
4.1.4

How reproducible:
create a AWS user with permission boundary that only allows the user to create a user of the permission boundary is set.

Steps to Reproduce:
1.
2.
3.

Actual results:


Expected results:


Additional info:

Comment 4 Devan Goodwin 2019-08-30 13:52:26 UTC
Docs for QE on this AWS functionality: https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_boundaries.html

Comment 6 Florin Peter 2019-09-03 18:33:02 UTC
Hey Oleg, 
what Info do you need?

Comment 7 Oleg Nesterov 2019-09-03 19:05:21 UTC
@Florin Peter , I've created a new user in AWS and in order to test it I need to know what policy should be attached and what boundary permissions should be set for this user? And after that I am going to create a new cluster using credentials of this user.

Comment 8 Florin Peter 2019-09-03 19:41:54 UTC
Our AWS account is management by another department but I will try to get you something that may can help you to test this.
We already tested 4.2.0-0.nightly-2019-08-27-072819 and I can confirm that the permission boundary is working correctly.

Comment 9 Oleg Nesterov 2019-09-03 19:58:08 UTC
oh, that is great. Anyway, if it is not so difficult , please try to get the info about configuration of aws account ). It will help us to understand clearly your scenarios and test it best way.
Thank you

Comment 10 Oleg Nesterov 2019-09-05 12:44:57 UTC
Verified on 4.2.0-0.nightly-2019-09-04-142146

Comment 11 errata-xmlrpc 2019-10-16 06:33:27 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2019:2922


Note You need to log in before you can comment on or make changes to this bug.