48 lines
1.5 KiB
Terraform
48 lines
1.5 KiB
Terraform
# # https://github.com/terraform-aws-modules/terraform-aws-eks-pod-identity
|
|
module "aws_lb_controller_pod_identity" {
|
|
source = "terraform-aws-modules/eks-pod-identity/aws"
|
|
|
|
name = "aws-loadbalancer-controller"
|
|
attach_aws_lb_controller_policy = true
|
|
associations = {
|
|
this = {
|
|
cluster_name = module.eks.cluster_name
|
|
namespace = "kube-system"
|
|
service_account = "aws-load-balancer-controller-sa"
|
|
}
|
|
}
|
|
}
|
|
|
|
# https://aws.amazon.com/blogs/containers/amazon-eks-pod-identity-a-new-way-for-applications-on-eks-to-obtain-iam-credentials/
|
|
module "CsiPodIdentity" {
|
|
source = "../modules/security_identity_compliance/iam-role-v2"
|
|
description = "EKSCSIDriverRole"
|
|
role-name = "AmazonEBSCSIDriverRole"
|
|
trusted-entity = jsonencode(
|
|
{
|
|
"Version" : "2012-10-17",
|
|
"Statement" : [
|
|
{
|
|
"Effect" : "Allow",
|
|
"Principal" : {
|
|
"Service" : "pods.eks.amazonaws.com"
|
|
},
|
|
"Action" : [
|
|
"sts:AssumeRole",
|
|
"sts:TagSession"
|
|
],
|
|
"Condition" : {
|
|
"StringEquals" : {
|
|
"aws:SourceAccount" : data.aws_caller_identity.current.account_id
|
|
}
|
|
}
|
|
}
|
|
]
|
|
}
|
|
)
|
|
# 2 policies are required for the ebs csi to work
|
|
attach-managed-policies = [
|
|
"arn:aws:iam::aws:policy/AmazonEC2ReadOnlyAccess",
|
|
"arn:aws:iam::aws:policy/service-role/AmazonEBSCSIDriverPolicy"
|
|
]
|
|
} |