mirror of
https://github.com/ysoftdevs/terraform-aws-eks.git
synced 2026-03-24 18:31:09 +01:00
fix: Auto Mode custom tag policy should apply to cluster role, not node role (#3242)
This commit is contained in:
Bryant Biggs
310
main.tf
310
main.tf
@@ -563,6 +563,160 @@ resource "aws_iam_policy" "cluster_encryption" {
|
||||
tags = merge(var.tags, var.cluster_encryption_policy_tags)
|
||||
}
|
||||
|
||||
data "aws_iam_policy_document" "custom" {
|
||||
count = local.create_iam_role && var.enable_auto_mode_custom_tags ? 1 : 0
|
||||
|
||||
dynamic "statement" {
|
||||
for_each = var.enable_auto_mode_custom_tags ? [1] : []
|
||||
|
||||
content {
|
||||
sid = "Compute"
|
||||
actions = [
|
||||
"ec2:CreateFleet",
|
||||
"ec2:RunInstances",
|
||||
"ec2:CreateLaunchTemplate",
|
||||
]
|
||||
resources = ["*"]
|
||||
|
||||
condition {
|
||||
test = "StringEquals"
|
||||
variable = "aws:RequestTag/eks:eks-cluster-name"
|
||||
values = ["$${aws:PrincipalTag/eks:eks-cluster-name}"]
|
||||
}
|
||||
|
||||
condition {
|
||||
test = "StringLike"
|
||||
variable = "aws:RequestTag/eks:kubernetes-node-class-name"
|
||||
values = ["*"]
|
||||
}
|
||||
|
||||
condition {
|
||||
test = "StringLike"
|
||||
variable = "aws:RequestTag/eks:kubernetes-node-pool-name"
|
||||
values = ["*"]
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
dynamic "statement" {
|
||||
for_each = var.enable_auto_mode_custom_tags ? [1] : []
|
||||
|
||||
content {
|
||||
sid = "Storage"
|
||||
actions = [
|
||||
"ec2:CreateVolume",
|
||||
"ec2:CreateSnapshot",
|
||||
]
|
||||
resources = [
|
||||
"arn:${local.partition}:ec2:*:*:volume/*",
|
||||
"arn:${local.partition}:ec2:*:*:snapshot/*",
|
||||
]
|
||||
|
||||
condition {
|
||||
test = "StringEquals"
|
||||
variable = "aws:RequestTag/eks:eks-cluster-name"
|
||||
values = ["$${aws:PrincipalTag/eks:eks-cluster-name}"]
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
dynamic "statement" {
|
||||
for_each = var.enable_auto_mode_custom_tags ? [1] : []
|
||||
|
||||
content {
|
||||
sid = "Networking"
|
||||
actions = ["ec2:CreateNetworkInterface"]
|
||||
resources = ["*"]
|
||||
|
||||
condition {
|
||||
test = "StringEquals"
|
||||
variable = "aws:RequestTag/eks:eks-cluster-name"
|
||||
values = ["$${aws:PrincipalTag/eks:eks-cluster-name}"]
|
||||
}
|
||||
|
||||
condition {
|
||||
test = "StringEquals"
|
||||
variable = "aws:RequestTag/eks:kubernetes-cni-node-name"
|
||||
values = ["*"]
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
dynamic "statement" {
|
||||
for_each = var.enable_auto_mode_custom_tags ? [1] : []
|
||||
|
||||
content {
|
||||
sid = "LoadBalancer"
|
||||
actions = [
|
||||
"elasticloadbalancing:CreateLoadBalancer",
|
||||
"elasticloadbalancing:CreateTargetGroup",
|
||||
"elasticloadbalancing:CreateListener",
|
||||
"elasticloadbalancing:CreateRule",
|
||||
"ec2:CreateSecurityGroup",
|
||||
]
|
||||
resources = ["*"]
|
||||
|
||||
condition {
|
||||
test = "StringEquals"
|
||||
variable = "aws:RequestTag/eks:eks-cluster-name"
|
||||
values = ["$${aws:PrincipalTag/eks:eks-cluster-name}"]
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
dynamic "statement" {
|
||||
for_each = var.enable_auto_mode_custom_tags ? [1] : []
|
||||
|
||||
content {
|
||||
sid = "ShieldProtection"
|
||||
actions = ["shield:CreateProtection"]
|
||||
resources = ["*"]
|
||||
|
||||
condition {
|
||||
test = "StringEquals"
|
||||
variable = "aws:RequestTag/eks:eks-cluster-name"
|
||||
values = ["$${aws:PrincipalTag/eks:eks-cluster-name}"]
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
dynamic "statement" {
|
||||
for_each = var.enable_auto_mode_custom_tags ? [1] : []
|
||||
|
||||
content {
|
||||
sid = "ShieldTagResource"
|
||||
actions = ["shield:TagResource"]
|
||||
resources = ["arn:${local.partition}:shield::*:protection/*"]
|
||||
|
||||
condition {
|
||||
test = "StringEquals"
|
||||
variable = "aws:RequestTag/eks:eks-cluster-name"
|
||||
values = ["$${aws:PrincipalTag/eks:eks-cluster-name}"]
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
resource "aws_iam_policy" "custom" {
|
||||
count = local.create_iam_role && var.enable_auto_mode_custom_tags ? 1 : 0
|
||||
|
||||
name = var.iam_role_use_name_prefix ? null : local.iam_role_name
|
||||
name_prefix = var.iam_role_use_name_prefix ? "${local.iam_role_name}-" : null
|
||||
path = var.iam_role_path
|
||||
description = var.iam_role_description
|
||||
|
||||
policy = data.aws_iam_policy_document.custom[0].json
|
||||
|
||||
tags = merge(var.tags, var.iam_role_tags)
|
||||
}
|
||||
|
||||
resource "aws_iam_role_policy_attachment" "custom" {
|
||||
count = local.create_iam_role && var.enable_auto_mode_custom_tags ? 1 : 0
|
||||
|
||||
policy_arn = aws_iam_policy.custom[0].arn
|
||||
role = aws_iam_role.this[0].name
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# EKS Addons
|
||||
################################################################################
|
||||
@@ -696,8 +850,6 @@ resource "aws_eks_identity_provider_config" "this" {
|
||||
locals {
|
||||
create_node_iam_role = local.create && var.create_node_iam_role && local.auto_mode_enabled
|
||||
node_iam_role_name = coalesce(var.node_iam_role_name, "${var.cluster_name}-eks-auto")
|
||||
|
||||
create_node_iam_role_custom_policy = local.create_node_iam_role && (var.enable_node_custom_tags_permissions || length(var.node_iam_role_policy_statements) > 0)
|
||||
}
|
||||
|
||||
data "aws_iam_policy_document" "node_assume_role_policy" {
|
||||
@@ -749,157 +901,3 @@ resource "aws_iam_role_policy_attachment" "eks_auto_additional" {
|
||||
policy_arn = each.value
|
||||
role = aws_iam_role.eks_auto[0].name
|
||||
}
|
||||
|
||||
resource "aws_iam_role_policy_attachment" "eks_auto_custom" {
|
||||
count = local.create_node_iam_role_custom_policy ? 1 : 0
|
||||
|
||||
policy_arn = aws_iam_policy.eks_auto_custom[0].arn
|
||||
role = aws_iam_role.eks_auto[0].name
|
||||
}
|
||||
|
||||
data "aws_iam_policy_document" "eks_auto_custom" {
|
||||
count = local.create_node_iam_role_custom_policy ? 1 : 0
|
||||
|
||||
dynamic "statement" {
|
||||
for_each = var.enable_node_custom_tags_permissions ? [1] : []
|
||||
|
||||
content {
|
||||
sid = "Compute"
|
||||
actions = [
|
||||
"ec2:CreateFleet",
|
||||
"ec2:RunInstances",
|
||||
"ec2:CreateLaunchTemplate",
|
||||
]
|
||||
resources = ["*"]
|
||||
|
||||
condition {
|
||||
test = "StringEquals"
|
||||
variable = "aws:RequestTag/eks:eks-cluster-name"
|
||||
values = ["$${aws:PrincipalTag/eks:eks-cluster-name}"]
|
||||
}
|
||||
|
||||
condition {
|
||||
test = "StringLike"
|
||||
variable = "aws:RequestTag/eks:kubernetes-node-class-name"
|
||||
values = ["*"]
|
||||
}
|
||||
|
||||
condition {
|
||||
test = "StringLike"
|
||||
variable = "aws:RequestTag/eks:kubernetes-node-pool-name"
|
||||
values = ["*"]
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
dynamic "statement" {
|
||||
for_each = var.enable_node_custom_tags_permissions ? [1] : []
|
||||
|
||||
content {
|
||||
sid = "Storage"
|
||||
actions = [
|
||||
"ec2:CreateVolume",
|
||||
"ec2:CreateSnapshot",
|
||||
]
|
||||
resources = [
|
||||
"arn:${local.partition}:ec2:*:*:volume/*",
|
||||
"arn:${local.partition}:ec2:*:*:snapshot/*",
|
||||
]
|
||||
|
||||
condition {
|
||||
test = "StringEquals"
|
||||
variable = "aws:RequestTag/eks:eks-cluster-name"
|
||||
values = ["$${aws:PrincipalTag/eks:eks-cluster-name}"]
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
dynamic "statement" {
|
||||
for_each = var.enable_node_custom_tags_permissions ? [1] : []
|
||||
|
||||
content {
|
||||
sid = "Networking"
|
||||
actions = ["ec2:CreateNetworkInterface"]
|
||||
resources = ["*"]
|
||||
|
||||
condition {
|
||||
test = "StringEquals"
|
||||
variable = "aws:RequestTag/eks:eks-cluster-name"
|
||||
values = ["$${aws:PrincipalTag/eks:eks-cluster-name}"]
|
||||
}
|
||||
|
||||
condition {
|
||||
test = "StringEquals"
|
||||
variable = "aws:RequestTag/eks:kubernetes-cni-node-name"
|
||||
values = ["*"]
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
dynamic "statement" {
|
||||
for_each = var.enable_node_custom_tags_permissions ? [1] : []
|
||||
|
||||
content {
|
||||
sid = "LoadBalancer"
|
||||
actions = [
|
||||
"elasticloadbalancing:CreateLoadBalancer",
|
||||
"elasticloadbalancing:CreateTargetGroup",
|
||||
"elasticloadbalancing:CreateListener",
|
||||
"elasticloadbalancing:CreateRule",
|
||||
"ec2:CreateSecurityGroup",
|
||||
]
|
||||
resources = ["*"]
|
||||
|
||||
condition {
|
||||
test = "StringEquals"
|
||||
variable = "aws:RequestTag/eks:eks-cluster-name"
|
||||
values = ["$${aws:PrincipalTag/eks:eks-cluster-name}"]
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
dynamic "statement" {
|
||||
for_each = var.enable_node_custom_tags_permissions ? [1] : []
|
||||
|
||||
content {
|
||||
sid = "ShieldProtection"
|
||||
actions = ["shield:CreateProtection"]
|
||||
resources = ["*"]
|
||||
|
||||
condition {
|
||||
test = "StringEquals"
|
||||
variable = "aws:RequestTag/eks:eks-cluster-name"
|
||||
values = ["$${aws:PrincipalTag/eks:eks-cluster-name}"]
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
dynamic "statement" {
|
||||
for_each = var.enable_node_custom_tags_permissions ? [1] : []
|
||||
|
||||
content {
|
||||
sid = "ShieldTagResource"
|
||||
actions = ["shield:TagResource"]
|
||||
resources = ["arn:${local.partition}:shield::*:protection/*"]
|
||||
|
||||
condition {
|
||||
test = "StringEquals"
|
||||
variable = "aws:RequestTag/eks:eks-cluster-name"
|
||||
values = ["$${aws:PrincipalTag/eks:eks-cluster-name}"]
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
resource "aws_iam_policy" "eks_auto_custom" {
|
||||
count = local.create_node_iam_role_custom_policy ? 1 : 0
|
||||
|
||||
name = var.node_iam_role_use_name_prefix ? null : local.node_iam_role_name
|
||||
name_prefix = var.node_iam_role_use_name_prefix ? "${local.node_iam_role_name}-" : null
|
||||
path = var.node_iam_role_path
|
||||
description = var.node_iam_role_description
|
||||
|
||||
policy = data.aws_iam_policy_document.eks_auto_custom[0].json
|
||||
|
||||
tags = merge(var.tags, var.node_iam_role_tags)
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user