ROSAENG-906: Request AWS additional SQS permissions for ROSA Managed Policies (Spot Instance Support)

[ratnam915]

Summary

• Adds sqs:ReceiveMessage and sqs:DeleteMessage permissions to the ROSANodePoolManagementPolicy (openshift_hcp_capa_controller_manager_credentials_policy.json) for both commercial and FedRAMP partitions.
• Permissions are scoped with aws:ResourceTag/red-hat: true condition to restrict access to Red Hat-managed SQS queues only.

Context

ROSA HCP is adding Spot instance support for NodePools. The AWS Node Termination Handler (NTH) needs to long-poll an SQS queue for EC2 spot interruption and rebalance recommendation events, and remove processed messages after acting on them. Without these permissions in the managed policy, the NTH deployment will fail to poll the SQS queue and spot interruption events will not be handled gracefully.

This MCC change is the source of truth for what gets submitted to AWS to publish a new version of ROSANodePoolManagementPolicy. A companion HyperShift PR keeps the inline (dev/test) policies in sync.

Test plan

• JSON validity confirmed for both commercial and FedRAMP policy files
• Actions (sqs:DeleteMessage, sqs:ReceiveMessage) present in both variants
• ARN partitions correct — commercial uses arn:aws:sqs, FedRAMP uses arn:aws-us-gov:sqs
• Tag condition (aws:ResourceTag/red-hat: true) present and identical in both variants
• No duplicate Sids in either policy

References

• Jira: ROSAENG-906
• Parent initiative: OCPSTRAT-1677
• Enhancement: OCPSTRAT-1677: AWS spot instance support for HyperShift enhancements#1951
• Companion HyperShift PR (inline policy sync): SREP-3880: Request AWS additional SQS permissions for ROSA Managed Policies (Spot Instance Support) hypershift#8134
• HyperShift implementation: CNTRLPLANE-1388: Spot with termination handler hypershift#7567
• HyperShift API changes: CNTRLPLANE-1388: Add Spot instance support in the API hypershift#7625

Summary by CodeRabbit

• Chores
  • Updated IAM permissions for HyperShift node pool controllers to support Amazon SQS message operations with conditional resource tagging. Changes applied to both standard AWS and AWS GovCloud environments.

[openshift-ci-robot]

@ratnam915: This pull request references ROSAENG-906 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "5.0.0" version, but no target version was set.

Details

In response to this:

Summary

• Adds sqs:ReceiveMessage and sqs:DeleteMessage permissions to the ROSANodePoolManagementPolicy (openshift_hcp_capa_controller_manager_credentials_policy.json) for both commercial and FedRAMP partitions.
• Permissions are scoped with aws:ResourceTag/red-hat: true condition to restrict access to Red Hat-managed SQS queues only.

Context

ROSA HCP is adding Spot instance support for NodePools. The AWS Node Termination Handler (NTH) needs to long-poll an SQS queue for EC2 spot interruption and rebalance recommendation events, and remove processed messages after acting on them. Without these permissions in the managed policy, the NTH deployment will fail to poll the SQS queue and spot interruption events will not be handled gracefully.

This MCC change is the source of truth for what gets submitted to AWS to publish a new version of ROSANodePoolManagementPolicy. A companion HyperShift PR keeps the inline (dev/test) policies in sync.

Test plan

• JSON validity confirmed for both commercial and FedRAMP policy files
• Actions (sqs:DeleteMessage, sqs:ReceiveMessage) present in both variants
• ARN partitions correct — commercial uses arn:aws:sqs, FedRAMP uses arn:aws-us-gov:sqs
• Tag condition (aws:ResourceTag/red-hat: true) present and identical in both variants
• No duplicate Sids in either policy

References

• Jira: ROSAENG-906
• Parent initiative: OCPSTRAT-1677
• Enhancement: OCPSTRAT-1677: AWS spot instance support for HyperShift enhancements#1951
• Companion HyperShift PR (inline policy sync): SREP-3880: Request AWS additional SQS permissions for ROSA Managed Policies (Spot Instance Support) hypershift#8134
• HyperShift implementation: CNTRLPLANE-1388: Spot with termination handler hypershift#7567
• HyperShift API changes: CNTRLPLANE-1388: Add Spot instance support in the API hypershift#7625

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: c2a63694-c2c9-4f56-9ecb-c32077d08889

📥 Commits

Reviewing files that changed from the base of the PR and between 5081077 and d554aa6.

📒 Files selected for processing (2)

• resources/sts/4.14/fedramp-hypershift/openshift_hcp_capa_controller_manager_credentials_policy.json
• resources/sts/hypershift/openshift_hcp_capa_controller_manager_credentials_policy.json

---

Walkthrough

IAM policy statements are added to the HCP controller manager credentials policies in both standard AWS and FedRAMP GovCloud environments, granting permissions for SQS message deletion and receipt operations on resources tagged with red-hat: "true".

Changes

Node Pool SQS Permissions

Layer / File(s)	Summary
SQS Message Operations in Controller Manager Policy resources/sts/hypershift/openshift_hcp_capa_controller_manager_credentials_policy.json, resources/sts/4.14/fedramp-hypershift/openshift_hcp_capa_controller_manager_credentials_policy.json	Both policy files receive the new NodePoolSQSActions statement permitting sqs:DeleteMessage and sqs:ReceiveMessage on SQS resources in their respective AWS regions (standard and GovCloud), restricted to resources where aws:ResourceTag/red-hat equals "true".

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Suggested labels

approved, lgtm

Suggested reviewers

• iamkirkbater
• clcollins
• smarthall

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: adding AWS SQS permissions to ROSA Managed Policies for Spot Instance support, which aligns with the actual changes in both policy files.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	This PR only modifies AWS IAM policy JSON files, not Ginkgo tests. The check for "Stable and Deterministic Test Names" is not applicable to this PR's scope.
Test Structure And Quality	✅ Passed	PR contains no Ginkgo test code. It only modifies IAM policy JSON files (SQS permissions), making the test structure review check not applicable.
Microshift Test Compatibility	✅ Passed	PR contains no Ginkgo e2e tests; only AWS IAM policy JSON files are modified. MicroShift test compatibility check is not applicable.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	No Ginkgo e2e tests are added in this PR; it only modifies IAM policy JSON files for SQS permissions.
Topology-Aware Scheduling Compatibility	✅ Passed	PR modifies only IAM policy JSON files (not deployment manifests, operator code, or controllers) and adds AWS SQS permissions without any Kubernetes scheduling constraints or topology assumptions.
Ote Binary Stdout Contract	✅ Passed	PR changes only static JSON IAM policy files; no Go code, test code, or executable code that could write to stdout is present or modified.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	PR adds only AWS IAM policy JSON files, not Ginkgo e2e tests. Custom check for IPv6/disconnected network test compatibility is not applicable.
No-Weak-Crypto	✅ Passed	PR modifies only IAM policy JSON configuration files with no cryptographic code, weak crypto usage, custom crypto implementations, or insecure token comparisons.
Container-Privileges	✅ Passed	PR modifies only AWS IAM policy JSON files (not container/K8s manifests), so the container-privileges check is not applicable. No privileged container configurations present.
No-Sensitive-Data-In-Logs	✅ Passed	PR modifies only IAM policy JSON files with no logging code or statements; check is not applicable to static policy definitions.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[joshbranham]

Please remove this change, FedRAMP uses the same managed policies from AWS, unsure why this file is here.

[ratnam915]

Done

[rafael-azevedo]

why red-hat resource tag versus the "aws:ResourceTag/red-hat-managed": "true" in this case ?

[ratnam915]

@rafael-azevedo : The SQS queues for the spot termination handler are created by HyperShift at runtime specifically for the Node Termination Handler. The red-hat-managed tag is used for infrastructure resources (EC2 instances, security groups, network interfaces) that are created during cluster provisioning and managed as part of the cluster lifecycle.

The red-hat tag is already an established pattern in this same policy for non-infrastructure resources — see the ManagedKMSRestrictedResourceTag and CreateGrantRestricted statements which use aws:ResourceTag/red-hat: true for KMS keys. The SQS queues follow the same pattern since they are operator-managed resources, not cluster infrastructure.

[rafael-azevedo]

/lgtm

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: rafael-azevedo, ratnam915

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• resources/sts/OWNERS [rafael-azevedo]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

@ratnam915: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.