feat(aws): enable shared IAM role in e2e

cmd/infra/aws/iam.go

@@ -1029,18 +1029,31 @@ func (o *CreateIAMOptions) CreateSharedOIDCRole(ctx context.Context, client iami
 		return "", fmt.Errorf("failed to create shared role: %w", err)
 	}
 
-	// Add all policies to the shared role as inline policies
+	// Add all policies to the shared role
 	for _, binding := range bindings {
-		policyName := fmt.Sprintf("%s-%s", roleName, binding.name)
-		_, err = client.PutRolePolicyWithContext(ctx, &iam.PutRolePolicyInput{
-			PolicyName:     aws.String(policyName),
-			PolicyDocument: aws.String(binding.policy),
-			RoleName:       aws.String(roleName),
-		})
-		if err != nil {
-			return "", fmt.Errorf("failed to add policy %q to shared role: %w", binding.name, err)
+		if o.UseROSAManagedPolicies && binding.rosaManagedPolicyARN != "" {
+			// Attach ROSA managed policy
+			_, err = client.AttachRolePolicyWithContext(ctx, &iam.AttachRolePolicyInput{
+				PolicyArn: aws.String(binding.rosaManagedPolicyARN),
+				RoleName:  aws.String(roleName),
+			})
+			if err != nil {
+				return "", fmt.Errorf("failed to attach managed policy %q to shared role: %w", binding.rosaManagedPolicyARN, err)
+			}
+			logger.Info("Attached managed policy to shared role", "policy", binding.rosaManagedPolicyARN, "role", roleName)
+		} else {
+			// Add inline policy
+			policyName := fmt.Sprintf("%s-%s", roleName, binding.name)
+			_, err = client.PutRolePolicyWithContext(ctx, &iam.PutRolePolicyInput{
+				PolicyName:     aws.String(policyName),
+				PolicyDocument: aws.String(binding.policy),
+				RoleName:       aws.String(roleName),
+			})
+			if err != nil {
+				return "", fmt.Errorf("failed to add policy %q to shared role: %w", binding.name, err)
+			}
+			logger.Info("Added inline policy to shared role", "policy", binding.name, "role", roleName)
 		}
-		logger.Info("Added policy to shared role", "policy", binding.name, "role", roleName)
 	}
 
 	// Add assume role policy if needed

test/e2e/util/options.go

@@ -284,6 +284,7 @@ func (o *Options) DefaultAWSOptions() hypershiftaws.RawCreateOptions {
 		MultiArch:              o.ConfigurableClusterOptions.AWSMultiArch,
 		PublicOnly:             true,
 		UseROSAManagedPolicies: true,
+		SharedRole:             true,
 	}
 	if IsLessThan(semver.MustParse("4.16.0")) {
 		opts.PublicOnly = false