Feat/iam role policy attachment

apis/v1alpha1/ack-generate-metadata.yaml

@@ -1,13 +1,13 @@
 ack_generate_info:
-  build_date: "2026-07-07T21:50:53Z"
+  build_date: "2026-07-15T06:43:09Z"
   build_hash: 0a6b791fa10a6140d862be334a6891868ee588eb
   go_version: go1.26.4
   version: v0.61.0
-api_directory_checksum: fcb205ac280ed1b0f107a291e5ea43d93c0991e9
+api_directory_checksum: 1160a330c5825c076085ff877addb26a2a8aa839
 api_version: v1alpha1
 aws_sdk_go_version: v1.32.6
 generator_config_info:
-  file_checksum: 1339c27fce2a31f19582bb8951f169b93d4af15b
+  file_checksum: 84916e0a47969ba21c2bc4b5633c7210474cc8dd
   original_file_name: generator.yaml
 last_modification:
   reason: API generation

apis/v1alpha1/generator.yaml

@@ -235,11 +235,17 @@ resources:
       # In order to support attaching zero or more policies to a role, we use
       # custom update code path code that uses the Attach/DetachRolePolicy API
       # calls to manage the set of PolicyARNs attached to this Role.
+      #
+      # Comparison is delegated to comparePolicies() in customPreCompare so that
+      # it can honor the additive policy-reconciliation mode annotation, where
+      # managed policies attached out-of-band are never treated as drift.
       Policies:
         type: "[]*string"
         references:
           resource: Policy
           path: Status.ACKResourceMetadata.ARN
+        compare:
+          is_ignored: true
       # These are policy documents that are added to the Role using the
       # Put/DeleteRolePolicy APIs, as compared to the Attach/DetachRolePolicy
       # APIs that are for non-inline managed policies.

apis/v1alpha1/role_policy_attachment.go

@@ -0,0 +1,59 @@
+// Copyright Amazon.com Inc. or its affiliates. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License"). You may
+// not use this file except in compliance with the License. A copy of the
+// License is located at
+//
+//     http://aws.amazon.com/apache2.0/
+//
+// or in the "license" file accompanying this file. This file is distributed
+// on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
+// express or implied. See the License for the specific language governing
+// permissions and limitations under the License.
+
+package v1alpha1
+
+import (
+	ackv1alpha1 "github.com/aws-controllers-k8s/runtime/apis/core/v1alpha1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+// RolePolicyAttachmentSpec defines the desired state of RolePolicyAttachment.
+type RolePolicyAttachmentSpec struct {
+	PolicyARN *string                                  `json:"policyARN,omitempty"`
+	PolicyRef *ackv1alpha1.AWSResourceReferenceWrapper `json:"policyRef,omitempty"`
+	RoleName  *string                                  `json:"roleName,omitempty"`
+	RoleRef   *ackv1alpha1.AWSResourceReferenceWrapper `json:"roleRef,omitempty"`
+}
+
+// RolePolicyAttachmentStatus defines the observed state of RolePolicyAttachment.
+type RolePolicyAttachmentStatus struct {
+	// +kubebuilder:validation:Optional
+	ACKResourceMetadata *ackv1alpha1.ResourceMetadata `json:"ackResourceMetadata"`
+	// +kubebuilder:validation:Optional
+	Conditions []*ackv1alpha1.Condition `json:"conditions"`
+	// +kubebuilder:validation:Optional
+	Attached *bool `json:"attached,omitempty"`
+}
+
+// RolePolicyAttachment is the Schema for the RolePolicyAttachments API.
+// +kubebuilder:object:root=true
+// +kubebuilder:subresource:status
+type RolePolicyAttachment struct {
+	metav1.TypeMeta   `json:",inline"`
+	metav1.ObjectMeta `json:"metadata,omitempty"`
+	Spec              RolePolicyAttachmentSpec   `json:"spec,omitempty"`
+	Status            RolePolicyAttachmentStatus `json:"status,omitempty"`
+}
+
+// RolePolicyAttachmentList contains a list of RolePolicyAttachment.
+// +kubebuilder:object:root=true
+type RolePolicyAttachmentList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata,omitempty"`
+	Items           []RolePolicyAttachment `json:"items"`
+}
+
+func init() {
+	SchemeBuilder.Register(&RolePolicyAttachment{}, &RolePolicyAttachmentList{})
+}

config/crd/bases/iam.services.k8s.aws_rolepolicyattachments.yaml

@@ -0,0 +1,157 @@
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.19.0
+  name: rolepolicyattachments.iam.services.k8s.aws
+spec:
+  group: iam.services.k8s.aws
+  names:
+    kind: RolePolicyAttachment
+    listKind: RolePolicyAttachmentList
+    plural: rolepolicyattachments
+    singular: rolepolicyattachment
+  scope: Namespaced
+  versions:
+  - name: v1alpha1
+    schema:
+      openAPIV3Schema:
+        description: RolePolicyAttachment is the Schema for the RolePolicyAttachments
+          API.
+        properties:
+          apiVersion:
+            description: |-
+              APIVersion defines the versioned schema of this representation of an object.
+              Servers should convert recognized schemas to the latest internal value, and
+              may reject unrecognized values.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+            type: string
+          kind:
+            description: |-
+              Kind is a string value representing the REST resource this object represents.
+              Servers may infer this from the endpoint the client submits requests to.
+              Cannot be updated.
+              In CamelCase.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: RolePolicyAttachmentSpec defines the desired state of RolePolicyAttachment.
+            properties:
+              policyARN:
+                type: string
+              policyRef:
+                description: "AWSResourceReferenceWrapper provides a wrapper around
+                  *AWSResourceReference\ntype to provide more user friendly syntax
+                  for references using 'from' field\nEx:\nAPIIDRef:\n\n\tfrom:\n\t
+                  \ name: my-api"
+                properties:
+                  from:
+                    description: |-
+                      AWSResourceReference provides all the values necessary to reference another
+                      k8s resource for finding the identifier(Id/ARN/Name)
+                    properties:
+                      name:
+                        type: string
+                      namespace:
+                        type: string
+                    type: object
+                type: object
+              roleName:
+                type: string
+              roleRef:
+                description: "AWSResourceReferenceWrapper provides a wrapper around
+                  *AWSResourceReference\ntype to provide more user friendly syntax
+                  for references using 'from' field\nEx:\nAPIIDRef:\n\n\tfrom:\n\t
+                  \ name: my-api"
+                properties:
+                  from:
+                    description: |-
+                      AWSResourceReference provides all the values necessary to reference another
+                      k8s resource for finding the identifier(Id/ARN/Name)
+                    properties:
+                      name:
+                        type: string
+                      namespace:
+                        type: string
+                    type: object
+                type: object
+            type: object
+          status:
+            description: RolePolicyAttachmentStatus defines the observed state of
+              RolePolicyAttachment.
+            properties:
+              ackResourceMetadata:
+                description: |-
+                  ResourceMetadata is common to all custom resources (CRs) managed by an ACK
+                  service controller. It is contained in the CR's `Status` member field and
+                  comprises various status and identifier fields useful to ACK for tracking
+                  state changes between Kubernetes and the backend AWS service API
+                properties:
+                  arn:
+                    description: |-
+                      ARN is the Amazon Resource Name for the resource. This is a
+                      globally-unique identifier and is set only by the ACK service controller
+                      once the controller has orchestrated the creation of the resource OR
+                      when it has verified that an "adopted" resource (a resource where the
+                      ARN annotation was set by the Kubernetes user on the CR) exists and
+                      matches the supplied CR's Spec field values.
+                      https://github.com/aws/aws-controllers-k8s/issues/270
+                    type: string
+                  ownerAccountID:
+                    description: |-
+                      OwnerAccountID is the AWS Account ID of the account that owns the
+                      backend AWS service API resource.
+                    type: string
+                  partition:
+                    description: Partition is the AWS partition in which the resource
+                      exists or will exist
+                    type: string
+                  region:
+                    description: Region is the AWS region in which the resource exists
+                      or will exist.
+                    type: string
+                required:
+                - ownerAccountID
+                - region
+                type: object
+              attached:
+                type: boolean
+              conditions:
+                items:
+                  description: |-
+                    Condition is the common struct used by all CRDs managed by ACK service
+                    controllers to indicate terminal states  of the CR and its backend AWS
+                    service API resource
+                  properties:
+                    lastTransitionTime:
+                      description: Last time the condition transitioned from one status
+                        to another.
+                      format: date-time
+                      type: string
+                    message:
+                      description: A human readable message indicating details about
+                        the transition.
+                      type: string
+                    reason:
+                      description: The reason for the condition's last transition.
+                      type: string
+                    status:
+                      description: Status of the condition, one of True, False, Unknown.
+                      type: string
+                    type:
+                      description: Type is the type of the Condition
+                      type: string
+                  required:
+                  - status
+                  - type
+                  type: object
+                type: array
+            type: object
+        type: object
+    served: true
+    storage: true
+    subresources:
+      status: {}