<p dir="auto">Currently, the IAM Policy template for Kubernetes master grants <code class="notranslate">ec2:*</code> permissions, which means the role have the API access to potentially terminate other instances even if they are not in the Kubernetes cluster.</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="    {
      &quot;Effect&quot;: &quot;Allow&quot;,
      &quot;Action&quot;: [&quot;ec2:*&quot;],
      &quot;Resource&quot;: [&quot;*&quot;]
    },"><pre class="notranslate"><code class="notranslate">    {
      "Effect": "Allow",
      "Action": ["ec2:*"],
      "Resource": ["*"]
    },
</code></pre></div>
<p dir="auto"><a href="https://github.com/kubernetes/kubernetes/blob/master/cluster/aws/templates/iam/kubernetes-master-policy.json#L6">https://github.com/kubernetes/kubernetes/blob/master/cluster/aws/templates/iam/kubernetes-master-policy.json#L6</a></p>
<p dir="auto">A suggestion is to instead whitelist the actions required for Kubernetes Master. A list to start with would be:</p>
<p dir="auto"><code class="notranslate">ec2:Describe*</code> to get ec2 instance metadata such as AZ information.<br>
<code class="notranslate">ec2:AttachVolume</code>, <code class="notranslate">ec2:DetachVolume</code> to support EBS mounting.</p>
<p dir="auto"><a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/justinsb/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/justinsb">@justinsb</a></p>
<p dir="auto">For example, the master currently has blanket permissions on ec2, and the minion has write access to the s3 bucket, but only needs read access.</p>
<p dir="auto">This may entail giving objects we create a prefix to enable stricter policies.</p>