<p>The <a href="https://kubernetes.io/docs/concepts/storage/volumes/" rel="nofollow noreferrer">documentation</a> doesn’t go into detail. I imagine I would at least need an iam role. </p>

mdornfe1
<p>This is the one used by kubespray, and is very likely indicative of a rational default:</p>

<p><a href="https://github.com/kubernetes-incubator/kubespray/blob/v2.5.0/contrib/aws_iam/kubernetes-minion-policy.json" rel="nofollow noreferrer">https://github.com/kubernetes-incubator/kubespray/blob/v2.5.0/contrib/aws_iam/kubernetes-minion-policy.json</a></p>

<p>with the tl;dr of that link being to create an <code>Allow</code> for the following actions:</p>

<ul>
<li><code>s3:*</code></li>
<li><code>ec2:Describe*</code></li>
<li><code>ec2:AttachVolume</code></li>
<li><code>ec2:DetachVolume</code></li>
<li><code>route53:*</code></li>
</ul>

<p>(although I would bet that <code>s3:*</code> is too wide, I don't have the information handy to provide a more constrained version; similar observation on the <code>route53:*</code>)</p>

<p>All of the <code>Resource</code> keys for those are <code>*</code> except the <code>s3:</code> one which restricts the resource to buckets beginning with <code>kubernetes-*</code> -- unknown if that's just an example, or there is something special in the kubernetes prefixed buckets. Obviously you might have a better list of items to populate the <code>Resource</code> keys to genuinely restrict attachable volumes (just be careful with dynamically provisioned volumes, as would be created by <code>PersistentVolume</code> resources)</p>
