Skip to main content

Component: eks-iam

This component is responsible for provisioning specific IAM roles for Kubernetes Service Accounts. IAM roles are created for the following Kubernetes projects:

  1. aws-load-balancer-controller
  2. cluster-proportional-autoscaler
  3. cert-manager
  4. external-dns

Usage​

Stack Level: Regional

Here's an example snippet for how to use this component.

components:
  terraform:
    eks-iam:
      vars:
        standard_service_accounts:
          - "alb-controller",
          - "external-dns"
          - "cert-manager"

Requirements​

NameVersion
terraform>= 0.13.0
aws>= 3.0
local>= 1.3
template>= 2.2

Providers​

NameVersion
aws>= 3.0
terraformn/a

Modules​

NameSourceVersion
alb-controller./modules/service-accountn/a
autoscaler./modules/service-accountn/a
cert-manager./modules/service-accountn/a
external-dns./modules/service-accountn/a
iam_roles../account-map/modules/iam-rolesn/a
thisgit::https://github.com/cloudposse/terraform-null-label.gittags/0.21.0

Resources​

NameType
aws_iam_policy_document.autoscalerdata source
aws_iam_policy_document.cert_managerdata source
aws_iam_policy_document.external_dnsdata source
aws_kms_alias.ssmdata source
terraform_remote_state.account_mapdata source
terraform_remote_state.dns_delegateddata source
terraform_remote_state.dns_gbl_delegateddata source
terraform_remote_state.eksdata source

Inputs​

NameDescriptionTypeDefaultRequired
account_map_environment_nameThe name of the environment where account_map is provisionedstring"gbl"no
account_map_stage_nameThe name of the stage where account_map is provisionedstring"root"no
additional_tag_mapAdditional tags for appending to tags_as_list_of_maps. Not added to tags.map(string){}no
attributesAdditional attributes (e.g. 1)list(string)[]no
contextSingle object for setting entire context at once.
See description of individual variables for details.
Leave string and numeric variables as null to use default value.
Individual variable settings (non-null) override settings in context object,
except for attributes, tags, and additional_tag_map, which are merged.
object({
    enabled             = bool
    namespace           = string
    environment         = string
    stage               = string
    name                = string
    delimiter           = string
    attributes          = list(string)
    tags                = map(string)
    additional_tag_map  = map(string)
    regex_replace_chars = string
    label_order         = list(string)
    id_length_limit     = number
  })
{
  "additional_tag_map": {},
  "attributes": [],
  "delimiter": null,
  "enabled": true,
  "environment": null,
  "id_length_limit": null,
  "label_order": [],
  "name": null,
  "namespace": null,
  "regex_replace_chars": null,
  "stage": null,
  "tags": {}
}
no
delimiterDelimiter to be used between namespace, environment, stage, name and attributes.
Defaults to - (hyphen). Set to "" to use no delimiter at all.		stringnullno
dns_gbl_delegated_environment_nameThe name of the environment where global dns_delegated is provisionedstring"gbl"no
enabledSet to false to prevent the module from creating any resourcesboolnullno
environmentEnvironment, e.g. 'uw2', 'us-west-2', OR 'prod', 'staging', 'dev', 'UAT'stringnullno
id_length_limitLimit id to this many characters.
Set to 0 for unlimited length.
Set to null for default, which is 0.
Does not affect id_full.		numbernullno
import_role_arnIAM Role ARN to use when importing a resourcestringnullno
kms_alias_nameAWS KMS alias used for encryption/decryption of SSM parameters default is alias used in SSMstring"alias/aws/ssm"no
label_orderThe naming order of the id output and Name tag.
Defaults to ["namespace", "environment", "stage", "name", "attributes"].
You can omit any of the 5 elements, but at least one must be present.		list(string)nullno
nameSolution name, e.g. 'app' or 'jenkins'stringnullno
namespaceNamespace, which could be your organization name or abbreviation, e.g. 'eg' or 'cp'stringnullno
optional_service_accountsList of optional service accounts to enablelist(string)[]no
regex_replace_charsRegex to replace chars with empty string in namespace, environment, stage and name.
If not set, "/[^a-zA-Z0-9-]/" is used to remove all characters other than hyphens, letters and digits.		stringnullno
regionAWS Regionstringn/ayes
stageStage, e.g. 'prod', 'staging', 'dev', OR 'source', 'build', 'test', 'deploy', 'release'stringnullno
standard_service_accountsList of standard service accounts expected to be enabled everywherelist(string)n/ayes
tagsAdditional tags (e.g. map('BusinessUnit','XYZ')map(string){}no
tfstate_account_idThe ID of the account where the Terraform remote state backend is provisionedstring""no
tfstate_assume_roleSet to false to use the caller's role to access the Terraform remote statebooltrueno
tfstate_bucket_environment_nameThe name of the environment for Terraform state bucketstring""no
tfstate_bucket_stage_nameThe name of the stage for Terraform state bucketstring"root"no
tfstate_existing_role_arnThe ARN of the existing IAM Role to access the Terraform remote state. If not provided and remote_state_assume_role is true, a role will be constructed from remote_state_role_arn_templatestring""no
tfstate_role_arn_templateIAM Role ARN template for accessing the Terraform remote statestring"arn:aws:iam::%s:role/%s-%s-%s-%s"no
tfstate_role_environment_nameThe name of the environment for Terraform state IAM rolestring"gbl"no
tfstate_role_nameIAM Role name for accessing the Terraform remote statestring"terraform"no
tfstate_role_stage_nameThe name of the stage for Terraform state IAM rolestring"root"no

Outputs​

NameDescription
service_accountsn/a

References​