From 660a1fa5e662d72b062355b0d9f1c69e652af51c Mon Sep 17 00:00:00 2001
From: asadawar <asadawar@users.noreply.github.com>
Date: Thu, 9 Jul 2026 22:44:23 +0530
Subject: [PATCH] OCPBUGS-92831: Add missing IAM permissions to HCP AWS STS
 role policy

The documented IAM policy for the HCP AWS STS CLI role is missing five
permissions that are present in the hypershift source
(cmd/infra/aws/create_cli_role.go). Without these, hcp destroy cluster
aws fails during IAM cleanup with AccessDenied errors.

Assisted-by: Claude Code
---
 modules/hcp-aws-create-role-sts-creds.adoc | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/modules/hcp-aws-create-role-sts-creds.adoc b/modules/hcp-aws-create-role-sts-creds.adoc
index f1b9246ff97e..9f9154ab2e7d 100644
--- a/modules/hcp-aws-create-role-sts-creds.adoc
+++ b/modules/hcp-aws-create-role-sts-creds.adoc
@@ -156,6 +156,7 @@ arn:aws:iam::820196288204:role/myrole
             "Action": [
                 "iam:CreateInstanceProfile",
                 "iam:DeleteInstanceProfile",
+                "iam:TagInstanceProfile",
                 "iam:GetRole",
                 "iam:UpdateAssumeRolePolicy",
                 "iam:GetInstanceProfile",
@@ -166,11 +167,15 @@ arn:aws:iam::820196288204:role/myrole
                 "iam:PutRolePolicy",
                 "iam:AddRoleToInstanceProfile",
                 "iam:CreateOpenIDConnectProvider",
+                "iam:TagOpenIDConnectProvider",
                 "iam:ListOpenIDConnectProviders",
                 "iam:DeleteRolePolicy",
                 "iam:UpdateRole",
                 "iam:DeleteOpenIDConnectProvider",
-                "iam:GetRolePolicy"
+                "iam:GetRolePolicy",
+                "iam:ListAttachedRolePolicies",
+                "iam:ListRolePolicies",
+                "iam:DetachRolePolicy"
             ],
             "Resource": "*"
         },