Restrict service permissions

aws-observability · Aug 14, 2024 · 26ae844 · 26ae844
1 parent 91bb1c5
commit 26ae844
Showing 1 changed file with 7 additions and 3 deletions.
diff --git a/charts/amazon-cloudwatch-observability/templates/operator-clusterrole.yaml b/charts/amazon-cloudwatch-observability/templates/operator-clusterrole.yaml
@@ -25,13 +25,17 @@ rules:
   verbs: ["patch","update" ]
 - apiGroups: [ "" ]
   resources: [ "services" ]
-  verbs: [ "create","delete","get","list","patch","update","watch" ]
+  verbs: [ "create","delete","get","list","watch" ]
+- apiGroups: [ "" ]
+  resources: [ "services" ]
+  resourceNames: [ "amazon-cloudwatch-observability-webhook-service", "cloudwatch-agent", "cloudwatch-agent-headless", "cloudwatch-agent-monitoring", "cloudwatch-agent-windows", "cloudwatch-agent-windows-headless", "cloudwatch-agent-windows-monitoring", "dcgm-exporter-service", "neuron-monitor-service" ]
+  verbs: [ "patch","update" ]
 - apiGroups: [ "apps" ]
   resources: [ "daemonsets" ]
-  verbs: [ "create","delete", "get","list","patch","update","watch" ]
+  verbs: [ "create","delete","get","list","patch","update","watch" ]
 - apiGroups: [ "apps" ]
   resources: [ "deployments" ]
-  verbs: [ "create","delete", "get","list","patch","update","watch" ]
+  verbs: [ "create","delete","get","list","patch","update","watch" ]
 - apiGroups: [ "apps" ]
   resources: [ "statefulsets" ]
   verbs: [ "create","delete","get","list","patch","update","watch" ]