docs: updating velero AWS policy with cluster tag

[briantwatson]

• Small documentation update following some changes we've made to environment we're managing

[Copilot]

Pull request overview

This PR updates the Velero AWS IAM policy documentation to use standard Kubernetes cluster ownership tags instead of EBS CSI driver-specific tags. The changes align the policy with Kubernetes conventions while simplifying the CreateTags permission statement.

Key changes:

• Replaced ebs.csi.aws.com/cluster tags with kubernetes.io/cluster/<YOUR_CLUSTER_NAME> tags across all policy statements
• Changed tag values from "true" to "owned" to match Kubernetes cluster ownership conventions
• Simplified the CreateTags statement from two conditions to one, changing the operator from ForAllValues to ForAnyValue

Comments suppressed due to low confidence (1)

docs/reference/configuration/backup-and-restore/velero-cloud.md:107

• The CreateTags statement was significantly simplified by removing one condition and changing the operator. The original policy had two conditions (one checking RequestTag and another checking ResourceTag with IfExists), while the new policy has only one. Additionally, the operator changed from ForAllValues:StringEquals to ForAnyValue:StringEquals.

ForAnyValue allows the CreateTags action as long as at least one of the tags being created matches the condition, permitting additional arbitrary tags in the same request. ForAllValues would require all tags in the request to match.

This is a substantial change in policy behavior that makes it more permissive. Please verify this aligns with your security requirements and that the removal of the ResourceTag condition check is intentional.

    condition {
      test     = "ForAnyValue:StringEquals"
      variable = "aws:RequestTag/kubernetes.io/cluster/<YOUR_CLUSTER_NAME>"
      values = ["owned"]
    }

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[joelmccoy]

I think these changes look good but would like to match our CI to ensure this still works and there aren't any gotchas. Would request that we update the policy for EKS

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.