diff --git a/pkg/resource/role/hooks.go b/pkg/resource/role/hooks.go index c749c21..5b5bcc7 100644 --- a/pkg/resource/role/hooks.go +++ b/pkg/resource/role/hooks.go @@ -31,6 +31,25 @@ import ( commonutil "github.com/aws-controllers-k8s/iam-controller/pkg/util" ) +func (rm *resourceManager) attachPolicies(ctx context.Context, r *resource) (err error) { + rlog := ackrtlog.FromContext(ctx) + exit := rlog.Trace("rm.attachPolicies") + defer func() { exit(err) }() + for _, p := range r.ko.Spec.Policies { + err := rm.addManagedPolicy(ctx, r, p) + if err != nil { + return err + } + } + for n, p := range r.ko.Spec.InlinePolicies { + err := rm.addInlinePolicy(ctx, r, n, p) + if err != nil { + return err + } + } + return nil +} + // putRolePermissionsBoundary calls the IAM API to set a given role // permission boundary. func (rm *resourceManager) putRolePermissionsBoundary( diff --git a/pkg/resource/role/sdk.go b/pkg/resource/role/sdk.go index c2ac7c9..2a338d3 100644 --- a/pkg/resource/role/sdk.go +++ b/pkg/resource/role/sdk.go @@ -324,6 +324,10 @@ func (rm *resourceManager) sdkCreate( ko.Spec.AssumeRolePolicyDocument = &doc } } + err = rm.attachPolicies(ctx, &resource{ko}) + if err != nil { + return &resource{ko}, err + } ackcondition.SetSynced(&resource{ko}, corev1.ConditionFalse, nil, nil) return &resource{ko}, nil diff --git a/templates/hooks/role/sdk_create_post_set_output.go.tpl b/templates/hooks/role/sdk_create_post_set_output.go.tpl index 08610d1..ac85411 100644 --- a/templates/hooks/role/sdk_create_post_set_output.go.tpl +++ b/templates/hooks/role/sdk_create_post_set_output.go.tpl @@ -5,4 +5,8 @@ ko.Spec.AssumeRolePolicyDocument = &doc } } + err = rm.attachPolicies(ctx, &resource{ko}) + if err != nil { + return &resource{ko}, err + } ackcondition.SetSynced(&resource{ko}, corev1.ConditionFalse, nil, nil)