---
apiVersion: cloudcredential.openshift.io/v1
kind: CredentialsRequest
metadata:
  annotations:
    exclude.release.openshift.io/internal-openshift-hosted: "true"
  creationTimestamp: "2022-03-08T10:13:44Z"
  generation: 1
  labels:
    controller-tools.k8s.io: "1.0"
  managedFields:
  - apiVersion: cloudcredential.openshift.io/v1
    fieldsType: FieldsV1
    fieldsV1:
      f:metadata:
        f:annotations:
          .: {}
          f:exclude.release.openshift.io/internal-openshift-hosted: {}
        f:labels:
          .: {}
          f:controller-tools.k8s.io: {}
      f:spec:
        .: {}
        f:providerSpec:
          .: {}
          f:apiVersion: {}
          f:kind: {}
          f:statementEntries: {}
        f:secretRef:
          .: {}
          f:name: {}
          f:namespace: {}
    manager: cluster-version-operator
    operation: Update
    time: "2022-03-08T10:13:44Z"
  name: openshift-machine-api-aws
  namespace: openshift-cloud-credential-operator
  resourceVersion: "799"
  selfLink: /apis/cloudcredential.openshift.io/v1/namespaces/openshift-cloud-credential-operator/credentialsrequests/openshift-machine-api-aws
  uid: 93568333-449d-4b98-b87e-8afbe04fc98b
spec:
  providerSpec:
    apiVersion: cloudcredential.openshift.io/v1
    kind: AWSProviderSpec
    statementEntries:
    - action:
      - ec2:CreateTags
      - ec2:DescribeAvailabilityZones
      - ec2:DescribeDhcpOptions
      - ec2:DescribeImages
      - ec2:DescribeInstances
      - ec2:DescribeSecurityGroups
      - ec2:DescribeSubnets
      - ec2:DescribeVpcs
      - ec2:RunInstances
      - ec2:TerminateInstances
      - elasticloadbalancing:DescribeLoadBalancers
      - elasticloadbalancing:DescribeTargetGroups
      - elasticloadbalancing:RegisterInstancesWithLoadBalancer
      - elasticloadbalancing:RegisterTargets
      - iam:PassRole
      - iam:CreateServiceLinkedRole
      effect: Allow
      resource: '*'
    - action:
      - kms:Decrypt
      - kms:Encrypt
      - kms:GenerateDataKey
      - kms:GenerateDataKeyWithoutPlainText
      - kms:DescribeKey
      effect: Allow
      resource: '*'
    - action:
      - kms:RevokeGrant
      - kms:CreateGrant
      - kms:ListGrants
      effect: Allow
      policyCondition:
        Bool:
          kms:GrantIsForAWSResource: true
      resource: '*'
  secretRef:
    name: aws-cloud-credentials
    namespace: openshift-machine-api
