Restrict ACK ACM controller IAM to read-only

[sanmesh-kakade]

Summary

• Remove IAM permissions that allow creating, importing, deleting, renewing, or modifying ACM certificates (RequestCertificate, ImportCertificate, DeleteCertificate, RenewCertificate, ExportCertificate, UpdateCertificateOptions)
• Retain only read and tag management permissions needed for adopting existing certs via AdoptedResource
• Enforces least-privilege access for the ACK ACM controller

Test plan

• Deploy updated module and verify ACK controller can adopt an existing ACM cert via AdoptedResource
• Verify controller can sync cert to Kubernetes Secret via exportTo
• Confirm RequestCertificate is denied (no new certs can be created)

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

🗂️ Base branches to auto review (1)

• facets-saas

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 71e22f9c-1314-4841-bba0-517e22494363

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fabric-fixes

📝 Coding Plan

• Generate coding plan for human review comments

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

Tip

CodeRabbit can enforce grammar and style rules using `languagetool`.

Configure the reviews.tools.languagetool setting to enable/disable rules and categories. Refer to the LanguageTool Community to learn more.

[sanmesh-kakade]

covered in #524