From 67fbaa9654561d3beb28509ca91869ed5f5a9057 Mon Sep 17 00:00:00 2001
From: lvadlamudi <lvadlamudi@fortinet.com>
Date: Fri, 28 Aug 2026 01:07:47 +0000
Subject: [PATCH] fix(lwpreflight): add S3 tagging and inline-policy reads to
 AWS lists

Newer aws provider versions pass bucket tags inside CreateBucket, which needs
s3:TagResource, and read them with s3:ListTagsForResource. Without them the
provider falls back to PutBucketTagging/GetBucketTagging, so onboarding still
succeeds but every run leaves AccessDenied entries in the customer's CloudTrail.
Add both to every list that already tags buckets (Agentless, CloudTrail, EKS
Audit Log; single-account and org), and s3:ListTagsForResource alone to org
Config, whose bucket is created untagged but still read.

Preflight reads the caller's inline policies with iam:GetRolePolicy (roles) and
iam:GetUserPolicy (users) in policy.go, but the EKS Audit Log lists never
required either, so a principal granted through an inline policy failed
preflight before terraform ran. Add both to the EKS lists; the other three
integrations already carry them.

Verified in QAN with roles holding exactly these lists (deployments 500-503).

CAD-2300
---
 lwpreflight/aws/constants.go | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/lwpreflight/aws/constants.go b/lwpreflight/aws/constants.go
index a2aa56919..eeaa533dc 100644
--- a/lwpreflight/aws/constants.go
+++ b/lwpreflight/aws/constants.go
@@ -120,7 +120,9 @@ var RequiredPermissions = map[IntegrationType][]string{
 		"s3:PutBucketOwnershipControls",
 		"s3:PutBucketPolicy",
 		"s3:PutBucketPublicAccessBlock",
+		"s3:ListTagsForResource",
 		"s3:PutBucketTagging",
+		"s3:TagResource",
 		"s3:PutBucketVersioning",
 		"s3:PutEncryptionConfiguration",
 		"s3:PutLifecycleConfiguration",
@@ -225,7 +227,9 @@ var RequiredPermissions = map[IntegrationType][]string{
 		"s3:PutBucketOwnershipControls",
 		"s3:PutBucketPolicy",
 		"s3:PutBucketPublicAccessBlock",
+		"s3:ListTagsForResource",
 		"s3:PutBucketTagging",
+		"s3:TagResource",
 		"s3:PutBucketVersioning",
 		"s3:PutEncryptionConfiguration",
 		"s3:PutObject",
@@ -275,11 +279,15 @@ var RequiredPermissions = map[IntegrationType][]string{
 		"s3:PutLifecycleConfiguration",
 		"s3:PutEncryptionConfiguration",
 		"s3:PutBucketNotification",
+		"s3:ListTagsForResource",
 		"s3:PutBucketTagging",
+		"s3:TagResource",
 		"s3:DeleteObjectVersion",
 		"iam:CreateRole",
 		"iam:DeleteRole",
 		"iam:GetRole",
+		"iam:GetRolePolicy",
+		"iam:GetUserPolicy",
 		"iam:ListRolePolicies",
 		"iam:ListAttachedRolePolicies",
 		"iam:ListPolicyVersions",
@@ -466,7 +474,9 @@ var RequiredPermissionsForOrg = map[IntegrationType][]string{
 		"s3:PutBucketOwnershipControls",
 		"s3:PutBucketPolicy",
 		"s3:PutBucketPublicAccessBlock",
+		"s3:ListTagsForResource",
 		"s3:PutBucketTagging",
+		"s3:TagResource",
 		"s3:PutBucketVersioning",
 		"s3:PutEncryptionConfiguration",
 		"s3:PutLifecycleConfiguration",
@@ -553,6 +563,7 @@ var RequiredPermissionsForOrg = map[IntegrationType][]string{
 		"s3:GetBucketPublicAccessBlock",
 		"s3:GetBucketRequestPayment",
 		"s3:GetBucketTagging",
+		"s3:ListTagsForResource",
 		"s3:GetBucketVersioning",
 		"s3:GetBucketWebsite",
 		"s3:GetEncryptionConfiguration",
@@ -655,7 +666,9 @@ var RequiredPermissionsForOrg = map[IntegrationType][]string{
 		"s3:PutBucketOwnershipControls",
 		"s3:PutBucketPolicy",
 		"s3:PutBucketPublicAccessBlock",
+		"s3:ListTagsForResource",
 		"s3:PutBucketTagging",
+		"s3:TagResource",
 		"s3:PutBucketVersioning",
 		"s3:PutEncryptionConfiguration",
 		"s3:PutObject",
@@ -711,11 +724,15 @@ var RequiredPermissionsForOrg = map[IntegrationType][]string{
 		"s3:PutLifecycleConfiguration",
 		"s3:PutEncryptionConfiguration",
 		"s3:PutBucketNotification",
+		"s3:ListTagsForResource",
 		"s3:PutBucketTagging",
+		"s3:TagResource",
 		"s3:DeleteObjectVersion",
 		"iam:CreateRole",
 		"iam:DeleteRole",
 		"iam:GetRole",
+		"iam:GetRolePolicy",
+		"iam:GetUserPolicy",
 		"iam:ListRolePolicies",
 		"iam:ListAttachedRolePolicies",
 		"iam:ListPolicyVersions",