github-mirrors/terraform-aws-eks
1
0
Fork 0
mirror of https://github.com/ysoftdevs/terraform-aws-eks.git synced 2026-01-16 16:47:20 +01:00
Code Issues Packages Projects Releases Wiki Activity

feat: Add SourceArn condition to Fargate profile trust policy (#3039)

Browse Source 
feat: add `SourceArn` condition to fargate-profile assume_role_policy
This commit is contained in:
Christopher Boyd
2024-05-16 17:58:31 -04:00
committed by GitHub
parent 92fca6fcf9
commit a070d7b2bd
2 changed files with 11 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
modules/fargate-profile/README.md
View File

@@ -52,6 +52,7 @@ No modules.
| [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source | | [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |
| [aws_iam_policy_document.assume_role_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source | | [aws_iam_policy_document.assume_role_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
| [aws_partition.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/partition) | data source | | [aws_partition.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/partition) | data source |
| [aws_region.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/region) | data source |
## Inputs ## Inputs

10
modules/fargate-profile/main.tf
View File

@@ -1,5 +1,6 @@
data "aws_partition" "current" {} data "aws_partition" "current" {}
data "aws_caller_identity" "current" {} data "aws_caller_identity" "current" {}
data "aws_region" "current" {}
locals { locals {
create_iam_role = var.create && var.create_iam_role create_iam_role = var.create && var.create_iam_role
@@ -30,6 +31,15 @@ data "aws_iam_policy_document" "assume_role_policy" {
type = "Service" type = "Service"
identifiers = ["eks-fargate-pods.amazonaws.com"] identifiers = ["eks-fargate-pods.amazonaws.com"]
} }
condition {
test = "ArnLike"
variable = "aws:SourceArn"
values = [
"arn:${data.aws_partition.current.partition}:eks:${data.aws_region.current.name}:${data.aws_caller_identity.current.account_id}:fargateprofile/${var.cluster_name}/*",
]
}
} }
} }