Restrict iam policy by tagging SG rules and shield protection

[oliviassss]

Issue

Currently, the controller does not tag SG rules or shield protection, and the IAM policy is allowing corresponding actions on all resources, which may lead to security concern.

Description

This PR adds the support for the controller to tag SG rules and shield protection, so that we can further scope down the corresponding IAM policies by tags. This PR also introduces new IAM policies for shield:TagResource on protection resource and ec2:CreateTags on security-group-rule resource.

manual test

1. create protection with Tags

{"level":"info","ts":"2024-08-08T20:35:40Z","logger":"controllers.ingress","msg":"enabling shield protection","resourceARN":"arn:aws:elasticloadbalancing:us-west-2:xxx:loadbalancer/app/k8s-game2048-ingress2-599830d081/6d6dde95299796b6","protectionName":"managed by aws-load-balancer-controller","TagKey":"elbv2.k8s.aws/cluster","TagValue":"sonyingy-jun17"}
{"level":"info","ts":"2024-08-08T20:35:41Z","logger":"controllers.ingress","msg":"enabled shield protection","resourceARN":"arn:aws:elasticloadbalancing:us-west-2:xxx:loadbalancer/app/k8s-game2048-ingress2-599830d081/6d6dde95299796b6","protectionName":"managed by aws-load-balancer-controller","protectionID":"d09c2d3f-8917-4380-9cde-3de9841ae92a"}

2. delete protection with Tags

{"level":"info","ts":"2024-08-08T20:37:34Z","logger":"controllers.ingress","msg":"disabling shield protection","resourceARN":"arn:aws:elasticloadbalancing:us-west-2:xxx:loadbalancer/app/k8s-game2048-ingress2-599830d081/6d6dde95299796b6","protectionID":"d09c2d3f-8917-4380-9cde-3de9841ae92a"}
{"level":"info","ts":"2024-08-08T20:37:35Z","logger":"controllers.ingress","msg":"disabled shield protection","resourceARN":"arn:aws:elasticloadbalancing:us-west-2:xxx:loadbalancer/app/k8s-game2048-ingress2-599830d081/6d6dde95299796b6"}

3. Authorize SG rules with tags
   
4. Revoke SG rules with tags by deleting the ingress resources

Checklist

• Added tests that cover your change (if possible)
• Added/modified documentation as required (such as the README.md, or the docs directory)
• Manually tested
• Made sure the title of the PR is a good description that can go into the release notes

BONUS POINTS checklist: complete for good vibes and maybe prizes?! 🤯

• Backfilled missing tests for code in same general area 🎉
• Refactored something and made the world a better place 🌟

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: oliviassss

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [oliviassss]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[oliviassss]

/retest

[k8s-ci-robot]

@oliviassss: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
pull-aws-load-balancer-controller-e2e-test	b43e277	link	true	/test pull-aws-load-balancer-controller-e2e-test

Full PR test history. Your PR dashboard. Please help us cut down on flakes by linking to an open issue when you hit one in your PR.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all PRs.

This bot triages PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the PR is closed

You can:

• Mark this PR as fresh with /remove-lifecycle stale
• Close this PR with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[michaelDovgal]

Oh, it's a very nice thing to have! Thanks for submitting this PR. wonder if it actually can be merged?

[k8s-ci-robot]

PR needs rebase.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[k8s-triage-robot]

The Kubernetes project currently lacks enough active contributors to adequately respond to all PRs.

This bot triages PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the PR is closed

You can:

• Mark this PR as fresh with /remove-lifecycle rotten
• Close this PR with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle rotten