From 58c4a0e30fe018157d6f67d990002a28c44b7424 Mon Sep 17 00:00:00 2001
From: Max Williams <max.williams@deliveryhero.com>
Date: Fri, 6 Jul 2018 16:31:55 +0200
Subject: [PATCH 1/6] initial commit

---
 aws_auth.tf                                   | 49 +++++++++++++++++--
 data.tf                                       |  8 ---
 .../config-map-aws-auth-map_accounts.yaml.tpl |  1 +
 .../config-map-aws-auth-map_roles.yaml.tpl    |  4 ++
 .../config-map-aws-auth-map_users.yaml.tpl    |  4 ++
 templates/config-map-aws-auth.yaml.tpl        |  7 ++-
 variables.tf                                  | 18 +++++++
 7 files changed, 79 insertions(+), 12 deletions(-)
 create mode 100644 templates/config-map-aws-auth-map_accounts.yaml.tpl
 create mode 100644 templates/config-map-aws-auth-map_roles.yaml.tpl
 create mode 100644 templates/config-map-aws-auth-map_users.yaml.tpl

diff --git a/aws_auth.tf b/aws_auth.tf
index 6038dc5..3dd9159 100644
--- a/aws_auth.tf
+++ b/aws_auth.tf
@@ -1,17 +1,60 @@
 resource "local_file" "config_map_aws_auth" {
   content  = "${data.template_file.config_map_aws_auth.rendered}"
   filename = "${var.config_output_path}/config-map-aws-auth.yaml"
-  count    = "${var.manage_aws_auth ? 1 : 0}"
+  count    = "${var.configure_kubectl_session ? 1 : 0}"
 }
 
-resource "null_resource" "update_config_map_aws_auth" {
+resource "null_resource" "configure_kubectl" {
   provisioner "local-exec" {
     command = "kubectl apply -f ${var.config_output_path}/config-map-aws-auth.yaml --kubeconfig ${var.config_output_path}/kubeconfig"
   }
 
   triggers {
     config_map_rendered = "${data.template_file.config_map_aws_auth.rendered}"
+    kubeconfig_rendered = "${data.template_file.kubeconfig.rendered}"
   }
 
-  count = "${var.manage_aws_auth ? 1 : 0}"
+  count = "${var.configure_kubectl_session ? 1 : 0}"
+}
+
+data "template_file" "config_map_aws_auth" {
+  template = "${file("${path.module}/templates/config-map-aws-auth.yaml.tpl")}"
+
+  vars {
+    worker_role_arn = "${aws_iam_role.workers.arn}"
+    map_users       = "${join("", data.template_file.map_users.*.rendered)}"
+    map_roles       = "${join("", data.template_file.map_roles.*.rendered)}"
+    map_accounts    = "${join("", data.template_file.map_accounts.*.rendered)}"
+  }
+}
+
+data "template_file" "map_users" {
+  count    = "${length(var.map_users)}"
+  template = "${file("${path.module}/templates/config-map-aws-auth-map_users.yaml.tpl")}"
+
+  vars {
+    user_arn = "${lookup(var.map_users[count.index], "user_arn")}"
+    username = "${lookup(var.map_users[count.index], "username")}"
+    group    = "${lookup(var.map_users[count.index], "group")}"
+  }
+}
+
+data "template_file" "map_roles" {
+  count    = "${length(var.map_roles)}"
+  template = "${file("${path.module}/templates/config-map-aws-auth-map_roles.yaml.tpl")}"
+
+  vars {
+    role_arn = "${lookup(var.map_roles[count.index], "role_arn")}"
+    username = "${lookup(var.map_roles[count.index], "username")}"
+    group    = "${lookup(var.map_roles[count.index], "group")}"
+  }
+}
+
+data "template_file" "map_accounts" {
+  count    = "${length(var.map_accounts)}"
+  template = "${file("${path.module}/templates/config-map-aws-auth-map_accounts.yaml.tpl")}"
+
+  vars {
+    account_number = "${element(var.map_accounts, count.index)}"
+  }
 }
diff --git a/data.tf b/data.tf
index 76a7eb6..0273182 100644
--- a/data.tf
+++ b/data.tf
@@ -73,14 +73,6 @@ EOF
   }
 }
 
-data "template_file" "config_map_aws_auth" {
-  template = "${file("${path.module}/templates/config-map-aws-auth.yaml.tpl")}"
-
-  vars {
-    role_arn = "${aws_iam_role.workers.arn}"
-  }
-}
-
 data "template_file" "userdata" {
   template = "${file("${path.module}/templates/userdata.sh.tpl")}"
   count    = "${length(var.worker_groups)}"
diff --git a/templates/config-map-aws-auth-map_accounts.yaml.tpl b/templates/config-map-aws-auth-map_accounts.yaml.tpl
new file mode 100644
index 0000000..26dc507
--- /dev/null
+++ b/templates/config-map-aws-auth-map_accounts.yaml.tpl
@@ -0,0 +1 @@
+    - "${account_number}"
diff --git a/templates/config-map-aws-auth-map_roles.yaml.tpl b/templates/config-map-aws-auth-map_roles.yaml.tpl
new file mode 100644
index 0000000..9f321b7
--- /dev/null
+++ b/templates/config-map-aws-auth-map_roles.yaml.tpl
@@ -0,0 +1,4 @@
+    - rolearn: ${role_arn}
+      username: ${username}
+      groups:
+        - ${group}
diff --git a/templates/config-map-aws-auth-map_users.yaml.tpl b/templates/config-map-aws-auth-map_users.yaml.tpl
new file mode 100644
index 0000000..92499de
--- /dev/null
+++ b/templates/config-map-aws-auth-map_users.yaml.tpl
@@ -0,0 +1,4 @@
+    - userarn: ${user_arn}
+      username: ${username}
+      groups:
+        - ${group}
diff --git a/templates/config-map-aws-auth.yaml.tpl b/templates/config-map-aws-auth.yaml.tpl
index 746817f..8cd42fe 100644
--- a/templates/config-map-aws-auth.yaml.tpl
+++ b/templates/config-map-aws-auth.yaml.tpl
@@ -5,8 +5,13 @@ metadata:
   namespace: kube-system
 data:
   mapRoles: |
-    - rolearn: ${role_arn}
+    - rolearn: ${worker_role_arn}
       username: system:node:{{EC2PrivateDNSName}}
       groups:
         - system:bootstrappers
         - system:nodes
+${map_roles}
+  mapUsers: |
+${map_users}
+  mapAccounts: |
+${map_accounts}
diff --git a/variables.tf b/variables.tf
index 35ccf90..9eb67c0 100644
--- a/variables.tf
+++ b/variables.tf
@@ -32,6 +32,24 @@ variable "manage_aws_auth" {
   default     = true
 }
 
+variable "map_accounts" {
+  description = "Additional AWS account numbers to add to the aws-auth configmap"
+  type        = "list"
+  default     = []
+}
+
+variable "map_roles" {
+  description = "Additional IAM roles to add to the aws-auth configmap"
+  type        = "list"
+  default     = []
+}
+
+variable "map_users" {
+  description = "Additional IAM users to add to the aws-auth configmap"
+  type        = "list"
+  default     = []
+}
+
 variable "subnets" {
   description = "A list of subnets to place the EKS cluster and workers within."
   type        = "list"

From 2775f35547d51203392b1d17655fc2e78e134e3f Mon Sep 17 00:00:00 2001
From: Max Williams <max.williams@deliveryhero.com>
Date: Tue, 10 Jul 2018 12:28:52 +0200
Subject: [PATCH 2/6] updating changelog, variables and readme

---
 CHANGELOG.md |  6 ++++++
 README.md    | 13 ++++++++-----
 variables.tf |  6 +++---
 3 files changed, 17 insertions(+), 8 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 2b2d754..a838e80 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,6 +5,12 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](http://keepachangelog.com/) and this
 project adheres to [Semantic Versioning](http://semver.org/).
 
+## [[v1.4.0](https://github.com/terraform-aws-modules/terraform-aws-eks/compare/v1.3.0...v1.4.0)] - 2018-07-12]
+
+### Added
+
+- New variables `map_accounts`, `map_roles` and `map_users` in order to manage additional entries in the `aws-auth` configmap. (by @max-rocket-internet)
+
 ## [[v1.3.0](https://github.com/terraform-aws-modules/terraform-aws-eks/compare/v1.2.0...v1.3.0)] - 2018-07-??]
 
 ### Added
diff --git a/README.md b/README.md
index 9ca9f01..34c6233 100644
--- a/README.md
+++ b/README.md
@@ -99,11 +99,13 @@ MIT Licensed. See [LICENSE](https://github.com/terraform-aws-modules/terraform-a
 | cluster_version | Kubernetes version to use for the EKS cluster. | string | `1.10` | no |
 | config_output_path | Determines where config files are placed if using configure_kubectl_session and you want config files to land outside the current working directory. | string | `./` | no |
 | configure_kubectl_session | Configure the current session's kubectl to use the instantiated EKS cluster. | string | `true` | no |
-| kubeconfig_aws_authenticator_additional_args | Any additional arguments to pass to the authenticator such as the role to assume. ["-r", "MyEksRole"] | list | `<list>` | no |
-| kubeconfig_aws_authenticator_command | Command to use to to fetch AWS EKS credentials. | string | `heptio-authenticator-aws` | no |
-| kubeconfig_aws_authenticator_env_variables | Environment variables that should be used when executing the authenticator. e.g. { AWS_PROFILE = "eks"} | map | `<map>` | no |
-| kubeconfig_name | Override the default name used for items kubeconfig. | string | `` | no |
-| manage_aws_auth | Whether to write and apply the aws-auth configmap file. | string | `true` | no |
+| kubeconfig_aws_authenticator_additional_args | Any additional arguments to pass to the authenticator such as the role to assume ["-r", "MyEksRole"] | string | `<list>` | no |
+| kubeconfig_aws_authenticator_command | Command to use to to fetch AWS EKS credentials | string | `heptio-authenticator-aws` | no |
+| kubeconfig_aws_authenticator_env_variables | Environment variables that should be used when executing the authenticator i.e. { AWS_PROFILE = "eks"} | string | `<map>` | no |
+| kubeconfig_name | Override the default name used for items kubeconfig | string | `` | no |
+| map_accounts | Additional AWS account numbers to add to the aws-auth configmap. | list | `<list>` | no |
+| map_roles | Additional IAM roles to add to the aws-auth configmap. | list | `<list>` | no |
+| map_users | Additional IAM users to add to the aws-auth configmap. | list | `<list>` | no |
 | subnets | A list of subnets to place the EKS cluster and workers within. | list | - | yes |
 | tags | A map of tags to add to all resources. | map | `<map>` | no |
 | vpc_id | VPC where the cluster and workers will be deployed. | string | - | yes |
@@ -128,3 +130,4 @@ MIT Licensed. See [LICENSE](https://github.com/terraform-aws-modules/terraform-a
 | worker_iam_role_name | IAM role name attached to EKS workers |
 | worker_security_group_id | Security group ID attached to the EKS workers. |
 | workers_asg_arns | IDs of the autoscaling groups containing workers. |
+
diff --git a/variables.tf b/variables.tf
index 9eb67c0..7855e5f 100644
--- a/variables.tf
+++ b/variables.tf
@@ -33,19 +33,19 @@ variable "manage_aws_auth" {
 }
 
 variable "map_accounts" {
-  description = "Additional AWS account numbers to add to the aws-auth configmap"
+  description = "Additional AWS account numbers to add to the aws-auth configmap."
   type        = "list"
   default     = []
 }
 
 variable "map_roles" {
-  description = "Additional IAM roles to add to the aws-auth configmap"
+  description = "Additional IAM roles to add to the aws-auth configmap."
   type        = "list"
   default     = []
 }
 
 variable "map_users" {
-  description = "Additional IAM users to add to the aws-auth configmap"
+  description = "Additional IAM users to add to the aws-auth configmap."
   type        = "list"
   default     = []
 }

From bb9e24102188801bf55c3c3990faf36e1900fe0d Mon Sep 17 00:00:00 2001
From: Max Williams <max.williams@deliveryhero.com>
Date: Tue, 10 Jul 2018 12:40:12 +0200
Subject: [PATCH 3/6] finishing doc, tests etc

---
 README.md                              |  9 +++---
 aws_auth.tf                            |  4 +--
 examples/eks_test_fixture/main.tf      |  3 ++
 examples/eks_test_fixture/variables.tf | 38 ++++++++++++++++++++++++++
 variables.tf                           |  6 ++--
 5 files changed, 50 insertions(+), 10 deletions(-)

diff --git a/README.md b/README.md
index 34c6233..693a2c0 100644
--- a/README.md
+++ b/README.md
@@ -63,7 +63,7 @@ Generate them like so:
 
 ```bash
 go get github.com/segmentio/terraform-docs
-terraform-docs md ./ | cat -s | ghead -n -1 > README.md
+terraform-docs md ./ | cat -s > README.md
 ```
 
 ## Contributing
@@ -103,9 +103,9 @@ MIT Licensed. See [LICENSE](https://github.com/terraform-aws-modules/terraform-a
 | kubeconfig_aws_authenticator_command | Command to use to to fetch AWS EKS credentials | string | `heptio-authenticator-aws` | no |
 | kubeconfig_aws_authenticator_env_variables | Environment variables that should be used when executing the authenticator i.e. { AWS_PROFILE = "eks"} | string | `<map>` | no |
 | kubeconfig_name | Override the default name used for items kubeconfig | string | `` | no |
-| map_accounts | Additional AWS account numbers to add to the aws-auth configmap. | list | `<list>` | no |
-| map_roles | Additional IAM roles to add to the aws-auth configmap. | list | `<list>` | no |
-| map_users | Additional IAM users to add to the aws-auth configmap. | list | `<list>` | no |
+| map_accounts | Additional AWS account numbers to add to the aws-auth configmap. See examples/eks_test_fixture/variables.tf for example format. | list | `<list>` | no |
+| map_roles | Additional IAM roles to add to the aws-auth configmap. See examples/eks_test_fixture/variables.tf for example format. | list | `<list>` | no |
+| map_users | Additional IAM users to add to the aws-auth configmap. See examples/eks_test_fixture/variables.tf for example format. | list | `<list>` | no |
 | subnets | A list of subnets to place the EKS cluster and workers within. | list | - | yes |
 | tags | A map of tags to add to all resources. | map | `<map>` | no |
 | vpc_id | VPC where the cluster and workers will be deployed. | string | - | yes |
@@ -130,4 +130,3 @@ MIT Licensed. See [LICENSE](https://github.com/terraform-aws-modules/terraform-a
 | worker_iam_role_name | IAM role name attached to EKS workers |
 | worker_security_group_id | Security group ID attached to the EKS workers. |
 | workers_asg_arns | IDs of the autoscaling groups containing workers. |
-
diff --git a/aws_auth.tf b/aws_auth.tf
index 3dd9159..ec32361 100644
--- a/aws_auth.tf
+++ b/aws_auth.tf
@@ -1,12 +1,12 @@
 resource "local_file" "config_map_aws_auth" {
   content  = "${data.template_file.config_map_aws_auth.rendered}"
-  filename = "${var.config_output_path}/config-map-aws-auth.yaml"
+  filename = "${var.config_output_path}/config-map-aws-auth_${var.cluster_name}.yaml"
   count    = "${var.configure_kubectl_session ? 1 : 0}"
 }
 
 resource "null_resource" "configure_kubectl" {
   provisioner "local-exec" {
-    command = "kubectl apply -f ${var.config_output_path}/config-map-aws-auth.yaml --kubeconfig ${var.config_output_path}/kubeconfig"
+    command = "kubectl apply -f ${var.config_output_path}/config-map-aws-auth_${var.cluster_name}.yaml --kubeconfig ${var.config_output_path}/kubeconfig_${var.cluster_name}"
   }
 
   triggers {
diff --git a/examples/eks_test_fixture/main.tf b/examples/eks_test_fixture/main.tf
index def2f32..6134a27 100644
--- a/examples/eks_test_fixture/main.tf
+++ b/examples/eks_test_fixture/main.tf
@@ -70,4 +70,7 @@ module "eks" {
   tags          = "${local.tags}"
   vpc_id        = "${module.vpc.vpc_id}"
   worker_groups = "${local.worker_groups}"
+  map_roles     = "${var.map_roles}"
+  map_users     = "${var.map_users}"
+  map_accounts  = "${var.map_accounts}"
 }
diff --git a/examples/eks_test_fixture/variables.tf b/examples/eks_test_fixture/variables.tf
index 81b8dbe..8d840bd 100644
--- a/examples/eks_test_fixture/variables.tf
+++ b/examples/eks_test_fixture/variables.tf
@@ -1,3 +1,41 @@
 variable "region" {
   default = "us-west-2"
 }
+
+variable "map_accounts" {
+  description = "Additional AWS account numbers to add to the aws-auth configmap."
+  type        = "list"
+  default     = [
+    "777777777777",
+    "888888888888"
+  ]
+}
+
+variable "map_roles" {
+  description = "Additional IAM roles to add to the aws-auth configmap."
+  type        = "list"
+  default     = [
+    {
+      role_arn = "arn:aws:iam::66666666666:role/role1"
+      username = "role1"
+      group = "system:masters"
+    }
+  ]
+}
+
+variable "map_users" {
+  description = "Additional IAM users to add to the aws-auth configmap."
+  type        = "list"
+  default     = [
+    {
+      user_arn = "arn:aws:iam::66666666666:user/user1"
+      username = "user1"
+      group  = "system:masters"
+    },
+    {
+      user_arn = "arn:aws:iam::66666666666:user/user2"
+      username = "user2"
+      group  = "system:masters"
+    }
+  ]
+}
diff --git a/variables.tf b/variables.tf
index 7855e5f..0bc65dc 100644
--- a/variables.tf
+++ b/variables.tf
@@ -33,19 +33,19 @@ variable "manage_aws_auth" {
 }
 
 variable "map_accounts" {
-  description = "Additional AWS account numbers to add to the aws-auth configmap."
+  description = "Additional AWS account numbers to add to the aws-auth configmap. See examples/eks_test_fixture/variables.tf for example format."
   type        = "list"
   default     = []
 }
 
 variable "map_roles" {
-  description = "Additional IAM roles to add to the aws-auth configmap."
+  description = "Additional IAM roles to add to the aws-auth configmap. See examples/eks_test_fixture/variables.tf for example format."
   type        = "list"
   default     = []
 }
 
 variable "map_users" {
-  description = "Additional IAM users to add to the aws-auth configmap."
+  description = "Additional IAM users to add to the aws-auth configmap. See examples/eks_test_fixture/variables.tf for example format."
   type        = "list"
   default     = []
 }

From e4263868e82037d78feeed7be95abf89353220d4 Mon Sep 17 00:00:00 2001
From: Max Williams <max.williams@deliveryhero.com>
Date: Wed, 11 Jul 2018 10:43:09 +0200
Subject: [PATCH 4/6] terraform fmt fix

---
 examples/eks_test_fixture/variables.tf | 21 ++++++++++++---------
 1 file changed, 12 insertions(+), 9 deletions(-)

diff --git a/examples/eks_test_fixture/variables.tf b/examples/eks_test_fixture/variables.tf
index 8d840bd..1c5f631 100644
--- a/examples/eks_test_fixture/variables.tf
+++ b/examples/eks_test_fixture/variables.tf
@@ -5,37 +5,40 @@ variable "region" {
 variable "map_accounts" {
   description = "Additional AWS account numbers to add to the aws-auth configmap."
   type        = "list"
-  default     = [
+
+  default = [
     "777777777777",
-    "888888888888"
+    "888888888888",
   ]
 }
 
 variable "map_roles" {
   description = "Additional IAM roles to add to the aws-auth configmap."
   type        = "list"
-  default     = [
+
+  default = [
     {
       role_arn = "arn:aws:iam::66666666666:role/role1"
       username = "role1"
-      group = "system:masters"
-    }
+      group    = "system:masters"
+    },
   ]
 }
 
 variable "map_users" {
   description = "Additional IAM users to add to the aws-auth configmap."
   type        = "list"
-  default     = [
+
+  default = [
     {
       user_arn = "arn:aws:iam::66666666666:user/user1"
       username = "user1"
-      group  = "system:masters"
+      group    = "system:masters"
     },
     {
       user_arn = "arn:aws:iam::66666666666:user/user2"
       username = "user2"
-      group  = "system:masters"
-    }
+      group    = "system:masters"
+    },
   ]
 }

From bad2e5ba982f8340c0a5157b744b6995a3dbe336 Mon Sep 17 00:00:00 2001
From: Max Williams <max.williams@deliveryhero.com>
Date: Wed, 11 Jul 2018 10:43:34 +0200
Subject: [PATCH 5/6] update readme with new doc update method and variable
 descriptions

---
 README.md | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/README.md b/README.md
index 693a2c0..90e4dec 100644
--- a/README.md
+++ b/README.md
@@ -63,7 +63,7 @@ Generate them like so:
 
 ```bash
 go get github.com/segmentio/terraform-docs
-terraform-docs md ./ | cat -s > README.md
+terraform-docs md ./ | cat -s | ghead -n -1 > README.md
 ```
 
 ## Contributing
@@ -98,11 +98,11 @@ MIT Licensed. See [LICENSE](https://github.com/terraform-aws-modules/terraform-a
 | cluster_security_group_id | If provided, the EKS cluster will be attached to this security group. If not given, a security group will be created with necessary ingres/egress to work with the workers and provide API access to your current IP/32. | string | `` | no |
 | cluster_version | Kubernetes version to use for the EKS cluster. | string | `1.10` | no |
 | config_output_path | Determines where config files are placed if using configure_kubectl_session and you want config files to land outside the current working directory. | string | `./` | no |
-| configure_kubectl_session | Configure the current session's kubectl to use the instantiated EKS cluster. | string | `true` | no |
-| kubeconfig_aws_authenticator_additional_args | Any additional arguments to pass to the authenticator such as the role to assume ["-r", "MyEksRole"] | string | `<list>` | no |
+| kubeconfig_aws_authenticator_additional_args | Any additional arguments to pass to the authenticator such as the role to assume ["-r", "MyEksRole"] | list | `<list>` | no |
 | kubeconfig_aws_authenticator_command | Command to use to to fetch AWS EKS credentials | string | `heptio-authenticator-aws` | no |
-| kubeconfig_aws_authenticator_env_variables | Environment variables that should be used when executing the authenticator i.e. { AWS_PROFILE = "eks"} | string | `<map>` | no |
-| kubeconfig_name | Override the default name used for items kubeconfig | string | `` | no |
+| kubeconfig_aws_authenticator_env_variables | Environment variables that should be used when executing the authenticator i.e. { AWS_PROFILE = "eks"} | map | `<map>` | no |
+| kubeconfig_name | Override the default name used for items kubeconfig. | string | `` | no |
+| manage_aws_auth | Whether to write and apply the aws-auth configmap file | string | `true` | no |
 | map_accounts | Additional AWS account numbers to add to the aws-auth configmap. See examples/eks_test_fixture/variables.tf for example format. | list | `<list>` | no |
 | map_roles | Additional IAM roles to add to the aws-auth configmap. See examples/eks_test_fixture/variables.tf for example format. | list | `<list>` | no |
 | map_users | Additional IAM users to add to the aws-auth configmap. See examples/eks_test_fixture/variables.tf for example format. | list | `<list>` | no |

From 6f886e6d37a28ecdca0ad8a538b2727d3be59442 Mon Sep 17 00:00:00 2001
From: Max Williams <max.williams@deliveryhero.com>
Date: Wed, 11 Jul 2018 10:48:44 +0200
Subject: [PATCH 6/6] fixing readme.md

Merge remote-tracking branch 'origin/aws-auth_enhancemnts' into aws-auth_enhancemnts
---
 .gitignore   | 1 +
 README.md    | 4 ++--
 aws_auth.tf  | 5 ++---
 variables.tf | 4 ++--
 4 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/.gitignore b/.gitignore
index e787fbf..8382e2a 100644
--- a/.gitignore
+++ b/.gitignore
@@ -11,3 +11,4 @@ kubeconfig
 config-map-aws-auth.yaml
 eks-admin-cluster-role-binding.yaml
 eks-admin-service-account.yaml
+.idea/
diff --git a/README.md b/README.md
index 90e4dec..652b778 100644
--- a/README.md
+++ b/README.md
@@ -102,7 +102,7 @@ MIT Licensed. See [LICENSE](https://github.com/terraform-aws-modules/terraform-a
 | kubeconfig_aws_authenticator_command | Command to use to to fetch AWS EKS credentials | string | `heptio-authenticator-aws` | no |
 | kubeconfig_aws_authenticator_env_variables | Environment variables that should be used when executing the authenticator i.e. { AWS_PROFILE = "eks"} | map | `<map>` | no |
 | kubeconfig_name | Override the default name used for items kubeconfig. | string | `` | no |
-| manage_aws_auth | Whether to write and apply the aws-auth configmap file | string | `true` | no |
+| manage_aws_auth | Whether to write and apply the aws-auth configmap file. | string | `true` | no |
 | map_accounts | Additional AWS account numbers to add to the aws-auth configmap. See examples/eks_test_fixture/variables.tf for example format. | list | `<list>` | no |
 | map_roles | Additional IAM roles to add to the aws-auth configmap. See examples/eks_test_fixture/variables.tf for example format. | list | `<list>` | no |
 | map_users | Additional IAM users to add to the aws-auth configmap. See examples/eks_test_fixture/variables.tf for example format. | list | `<list>` | no |
@@ -114,7 +114,7 @@ MIT Licensed. See [LICENSE](https://github.com/terraform-aws-modules/terraform-a
 | worker_sg_ingress_from_port | Minimum port number from which pods will accept communication. Must be changed to a lower value if some pods in your cluster will expose a port lower than 1025 (e.g. 22, 80, or 443). | string | `1025` | no |
 | workers_group_defaults | Default values for target groups as defined by the list of maps. | map | `<map>` | no |
 | workstation_cidr | Override the default ingress rule that allows communication with the EKS cluster API. If not given, will use current IP/32. | string | `` | no |
-| write_kubeconfig | Whether to write a kubeconfig file containing the cluster configuration | string | `true` | no |
+| write_kubeconfig | Whether to write a kubeconfig file containing the cluster configuration. | string | `true` | no |
 
 ## Outputs
 
diff --git a/aws_auth.tf b/aws_auth.tf
index ec32361..10edceb 100644
--- a/aws_auth.tf
+++ b/aws_auth.tf
@@ -1,17 +1,16 @@
 resource "local_file" "config_map_aws_auth" {
   content  = "${data.template_file.config_map_aws_auth.rendered}"
   filename = "${var.config_output_path}/config-map-aws-auth_${var.cluster_name}.yaml"
-  count    = "${var.configure_kubectl_session ? 1 : 0}"
+  count    = "${var.manage_aws_auth ? 1 : 0}"
 }
 
-resource "null_resource" "configure_kubectl" {
+resource "null_resource" "update_config_map_aws_auth" {
   provisioner "local-exec" {
     command = "kubectl apply -f ${var.config_output_path}/config-map-aws-auth_${var.cluster_name}.yaml --kubeconfig ${var.config_output_path}/kubeconfig_${var.cluster_name}"
   }
 
   triggers {
     config_map_rendered = "${data.template_file.config_map_aws_auth.rendered}"
-    kubeconfig_rendered = "${data.template_file.kubeconfig.rendered}"
   }
 
   count = "${var.configure_kubectl_session ? 1 : 0}"
diff --git a/variables.tf b/variables.tf
index 0bc65dc..d5c4b4a 100644
--- a/variables.tf
+++ b/variables.tf
@@ -23,12 +23,12 @@ variable "config_output_path" {
 }
 
 variable "write_kubeconfig" {
-  description = "Whether to write a kubeconfig file containing the cluster configuration"
+  description = "Whether to write a kubeconfig file containing the cluster configuration."
   default     = true
 }
 
 variable "manage_aws_auth" {
-  description = "Whether to write and apply the aws-auth configmap file"
+  description = "Whether to write and apply the aws-auth configmap file."
   default     = true
 }