fix: Ensure KMS key policy includes IAM role path (#979)

Co-authored-by: Bryant Biggs <[email protected]>

Author: mkkatica

data.tf

@@ -1,7 +1,5 @@
 data "aws_partition" "current" {}
-
 data "aws_caller_identity" "current" {}
-
 data "aws_region" "current" {}
 
 data "aws_eks_cluster" "cluster" {
@@ -106,7 +104,7 @@ data "aws_iam_policy_document" "eks_key" {
     principals {
       type = "AWS"
       identifiers = [
-        local.cluster_iam_role_arn
+        local.cluster_iam_role_pathed_arn
       ]
     }
   }
@@ -126,7 +124,7 @@ data "aws_iam_policy_document" "eks_key" {
     principals {
       type = "AWS"
       identifiers = [
-        local.cluster_iam_role_arn
+        local.cluster_iam_role_pathed_arn
       ]
     }
 

locals.tf

@@ -142,6 +142,7 @@ locals {
     }
   ] : []
 
-  cluster_iam_role_name = var.iam_role_name == null ? "${var.cluster_name}-cluster-role" : var.iam_role_name
-  cluster_iam_role_arn  = var.create_iam_role ? "arn:${local.context.aws_partition_id}:iam::${local.context.aws_caller_identity_account_id}:role/${local.cluster_iam_role_name}" : var.iam_role_arn
+  cluster_iam_role_name        = var.iam_role_name == null ? "${var.cluster_name}-cluster-role" : var.iam_role_name
+  cluster_iam_role_pathed_name = var.iam_role_path == null ? local.cluster_iam_role_name : "${trimprefix(var.iam_role_path, "/")}${local.cluster_iam_role_name}"
+  cluster_iam_role_pathed_arn  = var.create_iam_role ? "arn:${local.context.aws_partition_id}:iam::${local.context.aws_caller_identity_account_id}:role/${local.cluster_iam_role_pathed_name}" : var.iam_role_arn
 }