Enabling the AWS EFS CSI Driver Operator on ROSA - Potential action missing on policy elasticfilesystem:TagResource

[Daniel-M-Jacobson]

Hello, Just completed this process on ROSA HCP

I encountered an issue when using dynamic provisioning - error below
Events:
Normal Provisioning efs.csi.aws.com_worker-ip_provisioner-id External provisioner is provisioning volume for claim namespace/pvc-name
Warning ProvisioningFailed 2m32s (x9 over 4m39s) efs.csi.aws.com_worker-ip_provisioner-id failed to provision volume with StorageClass "efs-sc": rpc error: code = Unauthenticated desc = Access Denied. Please ensure you have the right AWS permissions: Access denied

I resolved this by adding the action "elasticfilesystem:TagResource" to the IAM policy defined in the section Create the IAM policy and role

After adding that permission, the PVC bound as expected.