Reduce Pulumi APIs Permission to Least Required for All Blob Storage (S3, Blob, GCP Bucket, etc).

[phillipedwards]

Hello!

• Vote on this issue by adding a 👍 reaction
• If you want to implement this feature, comment to let us know (we'll work with you on design, scheduling, etc.)

Issue details

Currently, the k8s Service Account used in the EKS installer uses the AmazonS3FullAccess Policy which is not only unnecessary, it is a gross over application of permissions, granting the service account full access to all S3 buckets in an account.

See: https://github.com/pulumi/pulumi-self-hosted-installers/blob/master/eks-hosted/03-apps/rbac.ts#L34

Reduce the scope of S3 Access for the service account to the specific buckets and actions needed for the Pulumi Service.

Note, all self-hosted installers should follow the below model shown with the ECS installer. That is, use least required privileges for blob storages.

Affected area/feature

Example of fix for the ECS Installer:

pulumi-self-hosted-installers/ecs-hosted/go/application/service/apiService.go

Lines 359 to 373 in 178f245

	policyDoc, err := json.Marshal(map[string]interface{}{
	"Version": "2012-10-17",
	"Statement": []map[string]interface{}{
	{
	"Effect": "Allow",
	"Action": []string{"s3:*"},
	"Resource": []string{
	checkpointBucketArn,
	fmt.Sprintf("%s/*", checkpointBucketArn),
	policypackBucketArn,
	fmt.Sprintf("%s/*", policypackBucketArn),
	},
	},
	},
	})