fence_aws_credentials_request.yaml

# similar to https://github.com/openshift/machine-api-operator/blob/master/install/0000_30_machine-api-operator_00_credentials-request.yaml#L1-L6
apiVersion: cloudcredential.openshift.io/v1
kind: CredentialsRequest
metadata:
  name: openshift-aws-cloud-fencing
  namespace: openshift-cloud-credential-operator
spec:
  serviceAccountNames:
  - fence-agents-remediation-controller-manager
  secretRef:
    name: aws-cloud-fencing-credentials-secret
    namespace: openshift-operators
  providerSpec:
    apiVersion: cloudcredential.openshift.io/v1
    kind: AWSProviderSpec
# https://github.com/openshift/cloud-credential-operator/blob/master/pkg/apis/cloudcredential/v1/types_aws.go
    statementEntries:
    - action:
      - ec2:StartInstances
      - ec2:StopInstances
      - ec2:DescribeImages
      - ec2:DescribeInstances
      - ec2:RunInstances
      - ec2:TerminateInstances
      - iam:PassRole
      - iam:CreateServiceLinkedRole
      effect: Allow
      resource: "*"
    - action:
      - kms:Decrypt
      - kms:Encrypt
      - kms:GenerateDataKey
      - kms:GenerateDataKeyWithoutPlainText
      - kms:DescribeKey
      effect: Allow
      resource: '*'
    - action:
      - kms:RevokeGrant
      - kms:CreateGrant
      - kms:ListGrants
      effect: Allow
      resource: '*'
      policyCondition:
        "Bool":
          "kms:GrantIsForAWSResource": true