mirror of
https://github.com/ysoftdevs/terraform-aws-eks.git
synced 2026-05-01 04:44:29 +02:00
feat: Add support for custom IAM role policy (#3087)
This commit is contained in:
Bryant Biggs
@@ -66,6 +66,7 @@ module "self_managed_node_group" {
|
||||
| [aws_eks_access_entry.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/eks_access_entry) | resource |
|
||||
| [aws_iam_instance_profile.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_instance_profile) | resource |
|
||||
| [aws_iam_role.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |
|
||||
| [aws_iam_role_policy.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy) | resource |
|
||||
| [aws_iam_role_policy_attachment.additional](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
|
||||
| [aws_iam_role_policy_attachment.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
|
||||
| [aws_launch_template.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/launch_template) | resource |
|
||||
@@ -74,6 +75,7 @@ module "self_managed_node_group" {
|
||||
| [aws_ec2_instance_type.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ec2_instance_type) | data source |
|
||||
| [aws_ec2_instance_type_offerings.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ec2_instance_type_offerings) | data source |
|
||||
| [aws_iam_policy_document.assume_role_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
|
||||
| [aws_iam_policy_document.role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
|
||||
| [aws_partition.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/partition) | data source |
|
||||
| [aws_ssm_parameter.ami](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ssm_parameter) | data source |
|
||||
| [aws_subnets.efa](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/subnets) | data source |
|
||||
@@ -106,6 +108,7 @@ module "self_managed_node_group" {
|
||||
| <a name="input_create_access_entry"></a> [create\_access\_entry](#input\_create\_access\_entry) | Determines whether an access entry is created for the IAM role used by the node group | `bool` | `true` | no |
|
||||
| <a name="input_create_autoscaling_group"></a> [create\_autoscaling\_group](#input\_create\_autoscaling\_group) | Determines whether to create autoscaling group or not | `bool` | `true` | no |
|
||||
| <a name="input_create_iam_instance_profile"></a> [create\_iam\_instance\_profile](#input\_create\_iam\_instance\_profile) | Determines whether an IAM instance profile is created or to use an existing IAM instance profile | `bool` | `true` | no |
|
||||
| <a name="input_create_iam_role_policy"></a> [create\_iam\_role\_policy](#input\_create\_iam\_role\_policy) | Determines whether an IAM role policy is created or not | `bool` | `true` | no |
|
||||
| <a name="input_create_launch_template"></a> [create\_launch\_template](#input\_create\_launch\_template) | Determines whether to create launch template or not | `bool` | `true` | no |
|
||||
| <a name="input_create_schedule"></a> [create\_schedule](#input\_create\_schedule) | Determines whether to create autoscaling group schedule or not | `bool` | `true` | no |
|
||||
| <a name="input_credit_specification"></a> [credit\_specification](#input\_credit\_specification) | Customize the credit specification of the instance | `map(string)` | `{}` | no |
|
||||
@@ -134,6 +137,7 @@ module "self_managed_node_group" {
|
||||
| <a name="input_iam_role_name"></a> [iam\_role\_name](#input\_iam\_role\_name) | Name to use on IAM role created | `string` | `null` | no |
|
||||
| <a name="input_iam_role_path"></a> [iam\_role\_path](#input\_iam\_role\_path) | IAM role path | `string` | `null` | no |
|
||||
| <a name="input_iam_role_permissions_boundary"></a> [iam\_role\_permissions\_boundary](#input\_iam\_role\_permissions\_boundary) | ARN of the policy that is used to set the permissions boundary for the IAM role | `string` | `null` | no |
|
||||
| <a name="input_iam_role_policy_statements"></a> [iam\_role\_policy\_statements](#input\_iam\_role\_policy\_statements) | A list of IAM policy [statements](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document#statement) - used for adding specific IAM permissions as needed | `any` | `[]` | no |
|
||||
| <a name="input_iam_role_tags"></a> [iam\_role\_tags](#input\_iam\_role\_tags) | A map of additional tags to add to the IAM role created | `map(string)` | `{}` | no |
|
||||
| <a name="input_iam_role_use_name_prefix"></a> [iam\_role\_use\_name\_prefix](#input\_iam\_role\_use\_name\_prefix) | Determines whether cluster IAM role name (`iam_role_name`) is used as a prefix | `bool` | `true` | no |
|
||||
| <a name="input_initial_lifecycle_hooks"></a> [initial\_lifecycle\_hooks](#input\_initial\_lifecycle\_hooks) | One or more Lifecycle Hooks to attach to the Auto Scaling Group before instances are launched. The syntax is exactly the same as the separate `aws_autoscaling_lifecycle_hook` resource, without the `autoscaling_group_name` attribute. Please note that this will only work when creating a new Auto Scaling Group. For all other use-cases, please use `aws_autoscaling_lifecycle_hook` resource | `list(map(string))` | `[]` | no |
|
||||
|
||||
@@ -470,6 +470,7 @@ resource "aws_launch_template" "this" {
|
||||
# require permissions on create/destroy that depend on nodes
|
||||
depends_on = [
|
||||
aws_iam_role_policy_attachment.this,
|
||||
aws_iam_role_policy_attachment.additional,
|
||||
]
|
||||
|
||||
lifecycle {
|
||||
@@ -861,6 +862,68 @@ resource "aws_iam_instance_profile" "this" {
|
||||
}
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# IAM Role Policy
|
||||
################################################################################
|
||||
|
||||
locals {
|
||||
create_iam_role_policy = local.create_iam_instance_profile && var.create_iam_role_policy && length(var.iam_role_policy_statements) > 0
|
||||
}
|
||||
|
||||
data "aws_iam_policy_document" "role" {
|
||||
count = local.create_iam_role_policy ? 1 : 0
|
||||
|
||||
dynamic "statement" {
|
||||
for_each = var.iam_role_policy_statements
|
||||
|
||||
content {
|
||||
sid = try(statement.value.sid, null)
|
||||
actions = try(statement.value.actions, null)
|
||||
not_actions = try(statement.value.not_actions, null)
|
||||
effect = try(statement.value.effect, null)
|
||||
resources = try(statement.value.resources, null)
|
||||
not_resources = try(statement.value.not_resources, null)
|
||||
|
||||
dynamic "principals" {
|
||||
for_each = try(statement.value.principals, [])
|
||||
|
||||
content {
|
||||
type = principals.value.type
|
||||
identifiers = principals.value.identifiers
|
||||
}
|
||||
}
|
||||
|
||||
dynamic "not_principals" {
|
||||
for_each = try(statement.value.not_principals, [])
|
||||
|
||||
content {
|
||||
type = not_principals.value.type
|
||||
identifiers = not_principals.value.identifiers
|
||||
}
|
||||
}
|
||||
|
||||
dynamic "condition" {
|
||||
for_each = try(statement.value.conditions, [])
|
||||
|
||||
content {
|
||||
test = condition.value.test
|
||||
values = condition.value.values
|
||||
variable = condition.value.variable
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
resource "aws_iam_role_policy" "this" {
|
||||
count = local.create_iam_role_policy ? 1 : 0
|
||||
|
||||
name = var.iam_role_use_name_prefix ? null : local.iam_role_name
|
||||
name_prefix = var.iam_role_use_name_prefix ? "${local.iam_role_name}-" : null
|
||||
policy = data.aws_iam_policy_document.role[0].json
|
||||
role = aws_iam_role.this[0].id
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# Placement Group
|
||||
################################################################################
|
||||
|
||||
@@ -645,6 +645,22 @@ variable "iam_role_tags" {
|
||||
default = {}
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# IAM Role Policy
|
||||
################################################################################
|
||||
|
||||
variable "create_iam_role_policy" {
|
||||
description = "Determines whether an IAM role policy is created or not"
|
||||
type = bool
|
||||
default = true
|
||||
}
|
||||
|
||||
variable "iam_role_policy_statements" {
|
||||
description = "A list of IAM policy [statements](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document#statement) - used for adding specific IAM permissions as needed"
|
||||
type = any
|
||||
default = []
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# Access Entry
|
||||
################################################################################
|
||||
|
||||
Reference in New Issue
Block a user