feat: Add conditional policy statement attachments for EKS IAM role module

.pre-commit-config.yaml

@@ -1,6 +1,6 @@
 repos:
   - repo: https://github.com/antonbabenko/pre-commit-terraform
-    rev: v1.62.3
+    rev: v1.64.0
     hooks:
       - id: terraform_fmt
       - id: terraform_validate

examples/iam-account/versions.tf

@@ -2,6 +2,9 @@ terraform {
   required_version = ">= 0.12.6"
 
   required_providers {
-    aws = ">= 2.23"
+    aws = {
+      source  = "hashicorp/aws"
+      version = ">= 2.23"
+    }
   }
 }

examples/iam-assumable-role-with-oidc/versions.tf

@@ -2,6 +2,9 @@ terraform {
   required_version = ">= 0.12.6"
 
   required_providers {
-    aws = ">= 2.23"
+    aws = {
+      source  = "hashicorp/aws"
+      version = ">= 2.23"
+    }
   }
 }

examples/iam-assumable-role-with-saml/versions.tf

@@ -2,6 +2,9 @@ terraform {
   required_version = ">= 0.12.6"
 
   required_providers {
-    aws = ">= 2.23"
+    aws = {
+      source  = "hashicorp/aws"
+      version = ">= 2.23"
+    }
   }
 }

examples/iam-assumable-role/versions.tf

@@ -2,6 +2,9 @@ terraform {
   required_version = ">= 0.12.6"
 
   required_providers {
-    aws = ">= 2.23"
+    aws = {
+      source  = "hashicorp/aws"
+      version = ">= 2.23"
+    }
   }
 }

examples/iam-assumable-roles-with-saml/versions.tf

@@ -2,6 +2,9 @@ terraform {
   required_version = ">= 0.12.6"
 
   required_providers {
-    aws = ">= 2.23"
+    aws = {
+      source  = "hashicorp/aws"
+      version = ">= 2.23"
+    }
   }
 }

examples/iam-assumable-roles/versions.tf

@@ -2,6 +2,9 @@ terraform {
   required_version = ">= 0.12.6"
 
   required_providers {
-    aws = ">= 2.23"
+    aws = {
+      source  = "hashicorp/aws"
+      version = ">= 2.23"
+    }
   }
 }

examples/iam-eks-role/README.md

@@ -1,6 +1,6 @@
 # IAM EKS role
 
-Configuration in this directory creates an IAM role that can be assumed by multiple EKS `ServiceAccount`.
+Configuration in this directory creates IAM roles that can be assumed by multiple EKS `ServiceAccount`s for various tasks.
 
 # Usage
 
@@ -21,29 +21,29 @@ Run `terraform destroy` when you don't need these resources.
 |------|---------|
 | <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 0.12.6 |
 | <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 2.23 |
-| <a name="requirement_random"></a> [random](#requirement\_random) | >= 2 |
 
 ## Providers
 
-| Name | Version |
-|------|---------|
-| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 2.23 |
-| <a name="provider_random"></a> [random](#provider\_random) | >= 2 |
+No providers.
 
 ## Modules
 
 | Name | Source | Version |
 |------|--------|---------|
-| <a name="module_eks"></a> [eks](#module\_eks) | terraform-aws-modules/eks/aws | ~> 18.0 |
+| <a name="module_cluster_autoscaler_irsa_role"></a> [cluster\_autoscaler\_irsa\_role](#module\_cluster\_autoscaler\_irsa\_role) | ../../modules/iam-eks-role | n/a |
+| <a name="module_ebs_csi_irsa_role"></a> [ebs\_csi\_irsa\_role](#module\_ebs\_csi\_irsa\_role) | ../../modules/iam-eks-role | n/a |
+| <a name="module_eks"></a> [eks](#module\_eks) | terraform-aws-modules/eks/aws | ~> 18.6 |
+| <a name="module_external_dns_irsa_role"></a> [external\_dns\_irsa\_role](#module\_external\_dns\_irsa\_role) | ../../modules/iam-eks-role | n/a |
 | <a name="module_iam_eks_role"></a> [iam\_eks\_role](#module\_iam\_eks\_role) | ../../modules/iam-eks-role | n/a |
+| <a name="module_karpenter_controller_irsa_role"></a> [karpenter\_controller\_irsa\_role](#module\_karpenter\_controller\_irsa\_role) | ../../modules/iam-eks-role | n/a |
+| <a name="module_node_termination_handler_irsa_role"></a> [node\_termination\_handler\_irsa\_role](#module\_node\_termination\_handler\_irsa\_role) | ../../modules/iam-eks-role | n/a |
+| <a name="module_vpc"></a> [vpc](#module\_vpc) | terraform-aws-modules/vpc/aws | ~> 3.0 |
+| <a name="module_vpc_cni_ipv4_irsa_role"></a> [vpc\_cni\_ipv4\_irsa\_role](#module\_vpc\_cni\_ipv4\_irsa\_role) | ../../modules/iam-eks-role | n/a |
+| <a name="module_vpc_cni_ipv6_irsa_role"></a> [vpc\_cni\_ipv6\_irsa\_role](#module\_vpc\_cni\_ipv6\_irsa\_role) | ../../modules/iam-eks-role | n/a |
 
 ## Resources
 
-| Name | Type |
-|------|------|
-| [random_pet.this](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/pet) | resource |
-| [aws_subnet_ids.all](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/subnet_ids) | data source |
-| [aws_vpc.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/vpc) | data source |
+No resources.
 
 ## Inputs
 

examples/iam-eks-role/main.tf

@@ -1,58 +1,213 @@
 provider "aws" {
-  region = "eu-west-1"
+  region = local.region
 }
 
-module "iam_eks_role" {
-  source    = "../../modules/iam-eks-role"
-  role_name = "my-app"
+locals {
+  name            = "ex-iam-eks-role"
+  cluster_version = "1.21"
+  region          = "eu-west-1"
 
-  cluster_service_accounts = {
-    (random_pet.this.id) = ["default:my-app", "canary:my-app"]
+  tags = {
+    Example    = local.name
+    GithubRepo = "terraform-aws-iam"
+    GithubOrg  = "terraform-aws-modules"
   }
+}
 
-  provider_url_sa_pairs = {
-    "oidc.eks.us-east-1.amazonaws.com/id/5C54DDF35ER19312844C7333374CC09D" = ["default:my-app2"]
-    "oidc.eks.ap-southeast-1.amazonaws.com/id/5C54DDF35ER54476848E7333374FF09G" = [
-      "default:my-app2",
-      "canary:my-app2",
-    ]
-  }
+################################################################################
+# AWS IAM EKS Role Module
+################################################################################
 
-  tags = {
-    Name = "eks-role"
+module "iam_eks_role" {
+  source = "../../modules/iam-eks-role"
+
+  role_name = local.name
+
+  oidc_providers = {
+    one = {
+      provider         = module.eks.oidc_provider
+      provider_arn     = module.eks.oidc_provider_arn
+      service_accounts = ["default:my-app", "canary:my-app"]
+    }
+    two = {
+      provider         = module.eks.oidc_provider
+      provider_arn     = module.eks.oidc_provider_arn
+      service_accounts = ["default:blue", "canary:blue"]
+    }
   }
 
   role_policy_arns = [
     "arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy"
   ]
+
+  tags = local.tags
 }
 
-##################
-# Extra resources
-##################
+module "cluster_autoscaler_irsa_role" {
+  source = "../../modules/iam-eks-role"
+
+  role_name                        = "cluster-autoscaler"
+  attach_cluster_autoscaler_policy = true
+
+  oidc_providers = {
+    ex = {
+      provider         = module.eks.oidc_provider
+      provider_arn     = module.eks.oidc_provider_arn
+      service_accounts = ["default:my-app", "canary:my-app"]
+    }
+  }
 
-resource "random_pet" "this" {
-  length = 2
+  tags = local.tags
 }
 
-module "eks" {
-  source  = "terraform-aws-modules/eks/aws"
-  version = "~> 18.0"
+module "external_dns_irsa_role" {
+  source = "../../modules/iam-eks-role"
 
-  cluster_name    = random_pet.this.id
-  cluster_version = "1.21"
+  role_name                  = "external-dns"
+  attach_external_dns_policy = true
+  external_dns_hosted_zones  = ["IClearlyMadeThisUp"]
+
+  oidc_providers = {
+    ex = {
+      provider         = module.eks.oidc_provider
+      provider_arn     = module.eks.oidc_provider_arn
+      service_accounts = ["default:my-app", "canary:my-app"]
+    }
+  }
+
+  tags = local.tags
+}
+
+module "ebs_csi_irsa_role" {
+  source = "../../modules/iam-eks-role"
+
+  role_name             = "ebs_csi"
+  attach_ebs_csi_policy = true
+
+  oidc_providers = {
+    ex = {
+      provider         = module.eks.oidc_provider
+      provider_arn     = module.eks.oidc_provider_arn
+      service_accounts = ["default:my-app", "canary:my-app"]
+    }
+  }
+
+  tags = local.tags
+}
+
+module "vpc_cni_ipv4_irsa_role" {
+  source = "../../modules/iam-eks-role"
+
+  role_name             = "vpc_cni_ipv4"
+  attach_vpc_cni_policy = true
+  vpc_cni_enable_ipv4   = true
+
+  oidc_providers = {
+    ex = {
+      provider         = module.eks.oidc_provider
+      provider_arn     = module.eks.oidc_provider_arn
+      service_accounts = ["default:my-app", "canary:my-app"]
+    }
+  }
+
+  tags = local.tags
+}
+
+module "vpc_cni_ipv6_irsa_role" {
+  source = "../../modules/iam-eks-role"
+
+  role_name             = "vpc_cni_ipv6"
+  attach_vpc_cni_policy = true
+  vpc_cni_enable_ipv6   = true
+
+  oidc_providers = {
+    ex = {
+      provider         = module.eks.oidc_provider
+      provider_arn     = module.eks.oidc_provider_arn
+      service_accounts = ["default:my-app", "canary:my-app"]
+    }
+  }
+
+  tags = local.tags
+}
+
+module "node_termination_handler_irsa_role" {
+  source = "../../modules/iam-eks-role"
 
-  vpc_id     = data.aws_vpc.default.id
-  subnet_ids = data.aws_subnet_ids.all.ids
+  role_name                              = "node_termination_handler"
+  attach_node_termination_handler_policy = true
+
+  oidc_providers = {
+    ex = {
+      provider         = module.eks.oidc_provider
+      provider_arn     = module.eks.oidc_provider_arn
+      service_accounts = ["default:my-app", "canary:my-app"]
+    }
+  }
+
+  tags = local.tags
 }
 
-##################################################################
-# Data sources to get VPC, subnet, security group and AMI details
-##################################################################
-data "aws_vpc" "default" {
-  default = true
+module "karpenter_controller_irsa_role" {
+  source = "../../modules/iam-eks-role"
+
+  role_name                          = "karpenter_controller"
+  attach_karpenter_controller_policy = true
+
+  oidc_providers = {
+    ex = {
+      provider         = module.eks.oidc_provider
+      provider_arn     = module.eks.oidc_provider_arn
+      service_accounts = ["default:my-app", "canary:my-app"]
+    }
+  }
+
+  tags = local.tags
 }
 
-data "aws_subnet_ids" "all" {
-  vpc_id = data.aws_vpc.default.id
+################################################################################
+# Supporting Resources
+################################################################################
+
+module "vpc" {
+  source  = "terraform-aws-modules/vpc/aws"
+  version = "~> 3.0"
+
+  name = local.name
+  cidr = "10.0.0.0/16"
+
+  azs             = ["${local.region}a", "${local.region}b", "${local.region}c"]
+  private_subnets = ["10.0.1.0/24", "10.0.2.0/24", "10.0.3.0/24"]
+  public_subnets  = ["10.0.4.0/24", "10.0.5.0/24", "10.0.6.0/24"]
+
+  enable_nat_gateway   = true
+  single_nat_gateway   = true
+  enable_dns_hostnames = true
+
+  enable_flow_log                      = true
+  create_flow_log_cloudwatch_iam_role  = true
+  create_flow_log_cloudwatch_log_group = true
+
+  public_subnet_tags = {
+    "kubernetes.io/cluster/${local.name}" = "shared"
+    "kubernetes.io/role/elb"              = 1
+  }
+
+  private_subnet_tags = {
+    "kubernetes.io/cluster/${local.name}" = "shared"
+    "kubernetes.io/role/internal-elb"     = 1
+  }
+
+  tags = local.tags
+}
+
+module "eks" {
+  source  = "terraform-aws-modules/eks/aws"
+  version = "~> 18.6"
+
+  cluster_name    = local.name
+  cluster_version = local.cluster_version
+
+  vpc_id     = module.vpc.vpc_id
+  subnet_ids = module.vpc.private_subnets
 }

examples/iam-eks-role/versions.tf

@@ -2,7 +2,9 @@ terraform {
   required_version = ">= 0.12.6"
 
   required_providers {
-    aws    = ">= 2.23"
-    random = ">= 2"
+    aws = {
+      source  = "hashicorp/aws"
+      version = ">= 2.23"
+    }
   }
 }

examples/iam-group-complete/versions.tf

@@ -2,6 +2,9 @@ terraform {
   required_version = ">= 0.12.6"
 
   required_providers {
-    aws = ">= 2.23"
+    aws = {
+      source  = "hashicorp/aws"
+      version = ">= 2.23"
+    }
   }
 }