DOC-2297: Cross-account IAM delegation for BYOC on AWS (draft)

[micheleRP]

Summary

Draft documentation for cross-account IAM delegation for BYOC on AWS (ENG-1139, targeted 26.2 / 2026-07-14). AWS-only, new clusters only; existing clusters and Azure/GCP keep the agent-based rpk cloud byoc apply model.

Jira: https://redpandadata.atlassian.net/browse/DOC-2297

Changes

• Reference: reworked the AWS section of security:partial$iam-policies.adoc from cloudv2 apps/redpanda-agent/infra/aws/redpanda/agent/instance_profile.tf (30 statements) into friendly, anchored sections with Permission | Access | Why it is needed tables and collapsible Terraform. The published partial had drifted ~90 actions behind source; this restores full parity. GCP and Azure sections reformatted to match (same structure), and refreshed from source to close drift.
• Concept: new "Provisioning models on AWS" section in byoc-arch.adoc (cross-account vs. agent-based comparison).
• How-to: reworked the existing AWS create page (create-byoc-cluster-aws.adoc) to be cross-account-first, gave it a cross-account-iam-aws page alias, and cross-linked it with the BYOC architecture page. (No separate page or nav entry was added.)
• What's New: draft July 2026 entry.

Status: DRAFT — not for merge

Open items are marked inline as TODO(team) / TODO(eng), pending SME confirmation (team post + Denis's permission-justification sheet):

1. Exact Cloud UI / deploy wizard steps (ENG-1129)
2. Customer role Terraform delivery mechanism
3. External ID surfacing + step ordering (CIAINFRA-3970)
4. Exact role name + trust policy content
5. Confirm the cross-account role grants the same permission set as the agent policy, and feature-gating (Redpanda SQL / AI Gateway / RDS). The "why it is needed" cells across AWS, GCP, and Azure are now filled in with high-confidence descriptions (researched by Sol 5.6). Only 4 permission cells still need eng confirmation:
   • ec2:ModifyVpcEndpointServicePayerResponsibility
   • Microsoft.ContainerService/managedClusters/listClusterAdminCredential/action
   • Microsoft.Network/publicIPPrefixes/join/action
   • Microsoft.Network/virtualNetworks/join/action

Preview pages

Deploy preview is still building; links go live once the Netlify deploy-preview check passes.

• AWS IAM Policies (updated via partial)
• GCP IAM Policies (updated via partial)
• Azure IAM Policies (updated via partial)
• BYOC Architecture (updated)
• BYOC (overview) (updated)
• Create a BYOC Cluster on AWS (updated)
• What's New in Redpanda Cloud (updated)

🤖 Generated with Claude Code

[netlify]

✅ Deploy Preview for rp-cloud ready!

Name	Link
🔨 Latest commit	70ed98b
🔍 Latest deploy log	https://app.netlify.com/projects/rp-cloud/deploys/6a554ee8cbc3760008650d18
😎 Deploy Preview	https://deploy-preview-633--rp-cloud.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: ffc58f53-6cac-4cc4-a360-af530200ff0e

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch DOC-2297-cross-account-iam

---

_{Comment @coderabbitai help to get the list of available commands.}

[micheleRP]

Open questions for engineering

The IAM permission tables are drafted, but a few cells and framing points need SME confirmation before this leaves draft. Every permission gets a customer-facing "Why it is needed" description, so for each item below I need the Redpanda-specific reason, not just what the cloud API does.

1. Permission justifications still marked TODO(eng)

AWS (@jacekseligarp @0xdiba)

• ec2:ModifyVpcEndpointServicePayerResponsibility: why does provisioning need to change payer responsibility on the cluster's PrivateLink endpoint service? What breaks without it?

Azure (@ncole)

• Microsoft.ContainerService/managedClusters/listClusterAdminCredential/action: do we use the admin kubeconfig (vs the listClusterUserCredential we already document), and for which operations? Flagging because the admin credential is full cluster-admin access.
• Microsoft.Network/publicIPPrefixes/join/action: what associates a public IP prefix with cluster resources (predictable egress, load balancer ingress)?
• Microsoft.Network/virtualNetworks/join/action: which resources join the VNet/subnet under this permission (private endpoints, AKS nodes, NAT)?

2. Accuracy / scope points to confirm

• Azure public DNS (@ncole): the role grants Microsoft.Network/dnszones/{read,write,delete} and dnszones/SOA/read, but no record-set permissions (dnszones/A/write, and so on), unlike the privateDnsZones block. Azure's model is that dnszones/write manages the zone, not record sets. Does Redpanda create or update public DNS records for cluster endpoints with this role? If yes, what grants that (is a record-set permission missing)? If no, I'll describe it as zone-level only.
• AWS secretsmanager:DeleteSecret (@jacekseligarp): what secrets does this cover, and which component creates and owns them? The current draft says "user secrets Redpanda created," which is ambiguous.
• AWS customer prerequisite (@0xdiba): to create the cross-account role and attach policies, what does the customer's own IAM principal actually need? The draft currently shows AWSAdministratorAccess as an example, but (a) the IAM managed policy is AdministratorAccess (AWSAdministratorAccess is the Identity Center permission-set name), and (b) recommending full admin conflicts with the least-privilege framing. What minimum should we document (for example IAMFullAccess, or a specific action set)?

3. Parity and feature-gating (affects which permissions we list)

• (@0xdiba) Does the AWS cross-account role grant the same permission set as the existing agent instance-profile policy, or does it differ?
• Which permissions are gated behind optional features (Redpanda SQL, AI Gateway, RDS, ElastiCache) and only present when the customer enables them? I want to mark those clearly.

4. Still open from the original draft (restating for completeness)

(@0xdiba @frenchfrywpepper)

• Deploy wizard and exact Cloud UI steps (ENG-1129).
• Delivery mechanism for the customer Terraform file (how does the customer receive it?).
• Whether the external ID is surfaced in the UI before role creation, and step ordering (CIAINFRA-3970).
• Exact role name and trust-policy content.

Thanks! Once these are answered I'll resolve the inline TODO(eng)/TODO(team) markers and take this out of draft.