updating iam doc with subnet policy (#2992)

* updating iam doc * adding describe subnet to scoped down policy
aws · Jul 23, 2024 · 2884e90 · 2884e90
1 parent e8faf2f
commit 2884e90
Showing 1 changed file with 2 additions and 0 deletions.
diff --git a/docs/iam-policy.md b/docs/iam-policy.md
@@ -22,6 +22,7 @@ In general, you can grant below IAM policies to Amazon VPC CNI plugin depending
                 "ec2:DescribeTags",
                 "ec2:DescribeNetworkInterfaces",
                 "ec2:DescribeInstanceTypes",
+                "ec2:DescribeSubnets",
                 "ec2:DetachNetworkInterface",
                 "ec2:ModifyNetworkInterfaceAttribute",
                 "ec2:UnassignPrivateIpAddresses"
@@ -102,6 +103,7 @@ Note:
                 "ec2:DescribeInstances",
                 "ec2:DescribeTags",
                 "ec2:DescribeNetworkInterfaces",
+                "ec2:DescribeSubnets",
                 "ec2:DescribeInstanceTypes"
             ],
             "Resource": "*"