apiVersion: v1
kind: ConfigMap
metadata:
  name: nodepolicy
data:
  node-trust-policy.json: |2
    {
      "Version": "2012-10-17",
      "Statement": [
        {
          "Effect": "Allow",
          "Principal": {
            "Service": "ec2.amazonaws.com"
          },
          "Action": ["sts:AssumeRole"]
        },
        {
          "Effect": "Allow",
          "Principal": {
            "AWS": "arn:aws:iam::385595570414:role/iam-validator-server"
          },
          "Action": ["sts:AssumeRole"]
        }
      ]
    }
  node-policy.json: |2
    {
      "Version": "2012-10-17",
      "Statement": [
        {
          "Effect": "Allow",
          "Action": [
            "ec2:AttachVolume",
            "ec2:DetachVolume",
            "ec2:ModifyVolume",
            "ec2:CreateVolume",
            "ec2:DeleteVolume"
          ],
          "Resource": "*"
        },
        {
          "Effect": "Allow",
          "Action": [
            "ec2:DescribeAvailabilityZones",
            "ec2:DescribeInstances",
            "ec2:DescribeTags",
            "ec2:DescribeVolumes",
            "ec2:DescribeVolumesModifications",
            "ec2:DescribeSnapshots"
          ],
          "Resource": "*"
        },
        {
          "Effect": "Allow",
          "Action": [
            "ec2:CreateTags"
          ],
          "Resource": [
            "arn:aws:ec2:*:*:volume/*"
          ],
          "Condition": {
            "StringEquals": {
              "ec2:CreateAction": [
                "CreateVolume"
              ]
            }
          }
        },
        {
          "Effect": "Allow",
          "Action": [
            "ec2:DeleteTags",
            "ec2:CreateSnapshot"
          ],
          "Resource": [
            "arn:aws:ec2:*:*:volume/*"
          ]
        },
        {
          "Action": [
            "autoscaling:DescribeAutoScalingGroups",
            "autoscaling:DescribeAutoScalingInstances",
            "autoscaling:DescribeLaunchConfigurations",
            "autoscaling:DescribeTags",
            "autoscaling:SetDesiredCapacity",
            "autoscaling:TerminateInstanceInAutoScalingGroup",
            "ec2:DescribeLaunchTemplateVersions",
            "eks:DescribeNodegroup"
          ],
          "Resource": "*",
          "Effect": "Allow"
        },
        {
          "Effect": "Allow",
          "Action": [
            "sts:AssumeRole"
          ],
          "Resource": [
            "*"
          ]
        },
        {
          "Effect": "Allow",
          "Action": [
            "kms:Decrypt",
            "kms:Encrypt",
            "kms:GenerateDataKey",
            "kms:GenerateDataKeyWithoutPlaintext",
            "kms:CreateGrant",
            "kms:DescribeKey"
          ],
          "Resource": [
            "*"
          ]
        },
        {
          "Sid": "awspcaissuer",
          "Action": [
            "acm-pca:DescribeCertificateAuthority",
            "acm-pca:GetCertificate",
            "acm-pca:IssueCertificate",
            "acm-pca:GetCertificateAuthorityCertificate"
          ],
          "Effect": "Allow",
          "Resource": [
            "*"
          ]
        },
        {
          "Effect": "Allow",
          "Action": [
            "sqs:SendMessage"
          ],
          "Resource": [
            "arn:aws:sqs:*:*:ingress-mim.fifo",
            "arn:aws:sqs:*:*:ingress-mim-tmp.fifo"
          ]
        },
        {
          "Effect": "Allow",
          "Action": [
            "ec2:CreateTags",
            "ec2:DeleteTags",
            "ec2:CreateSnapshot",
            "ec2:DeleteSnapshot",
            "ebs:ListSnapshotBlocks",
            "ebs:ListChangedBlocks"
          ],
          "Resource": "arn:aws:ec2:*:*:snapshot/*"
        }
      ]
    }