Skip to content

Commit a07013a

Browse files
bryantbiggsbryantbiggs
authored
fix: Auto Mode custom tag policy should apply to cluster role, not node role (#3242)
1 parent bba5a75 commit a07013a

File tree

3 files changed

+164
-173
lines changed

3 files changed

+164
-173
lines changed

‎README.md

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -354,14 +354,14 @@ We are grateful to the community for contributing bugfixes and improvements! Ple
354354
| [aws_iam_openid_connect_provider.oidc_provider](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_openid_connect_provider) | resource |
355355
| [aws_iam_policy.cluster_encryption](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
356356
| [aws_iam_policy.cni_ipv6_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
357-
| [aws_iam_policy.eks_auto_custom](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
357+
| [aws_iam_policy.custom](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
358358
| [aws_iam_role.eks_auto](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |
359359
| [aws_iam_role.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |
360360
| [aws_iam_role_policy_attachment.additional](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
361361
| [aws_iam_role_policy_attachment.cluster_encryption](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
362+
| [aws_iam_role_policy_attachment.custom](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
362363
| [aws_iam_role_policy_attachment.eks_auto](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
363364
| [aws_iam_role_policy_attachment.eks_auto_additional](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
364-
| [aws_iam_role_policy_attachment.eks_auto_custom](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
365365
| [aws_iam_role_policy_attachment.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
366366
| [aws_security_group.cluster](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group) | resource |
367367
| [aws_security_group.node](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group) | resource |
@@ -372,7 +372,7 @@ We are grateful to the community for contributing bugfixes and improvements! Ple
372372
| [aws_eks_addon_version.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/eks_addon_version) | data source |
373373
| [aws_iam_policy_document.assume_role_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
374374
| [aws_iam_policy_document.cni_ipv6_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
375-
| [aws_iam_policy_document.eks_auto_custom](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
375+
| [aws_iam_policy_document.custom](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
376376
| [aws_iam_policy_document.node_assume_role_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
377377
| [aws_iam_session_context.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_session_context) | data source |
378378
| [aws_partition.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/partition) | data source |
@@ -435,11 +435,11 @@ We are grateful to the community for contributing bugfixes and improvements! Ple
435435
| <a name="input_dataplane_wait_duration"></a> [dataplane\_wait\_duration](#input\_dataplane\_wait\_duration) | Duration to wait after the EKS cluster has become active before creating the dataplane components (EKS managed node group(s), self-managed node group(s), Fargate profile(s)) | `string` | `"30s"` | no |
436436
| <a name="input_eks_managed_node_group_defaults"></a> [eks\_managed\_node\_group\_defaults](#input\_eks\_managed\_node\_group\_defaults) | Map of EKS managed node group default configurations | `any` | `{}` | no |
437437
| <a name="input_eks_managed_node_groups"></a> [eks\_managed\_node\_groups](#input\_eks\_managed\_node\_groups) | Map of EKS managed node group definitions to create | `any` | `{}` | no |
438+
| <a name="input_enable_auto_mode_custom_tags"></a> [enable\_auto\_mode\_custom\_tags](#input\_enable\_auto\_mode\_custom\_tags) | Determines whether to enable permissions for custom tags resources created by EKS Auto Mode | `bool` | `true` | no |
438439
| <a name="input_enable_cluster_creator_admin_permissions"></a> [enable\_cluster\_creator\_admin\_permissions](#input\_enable\_cluster\_creator\_admin\_permissions) | Indicates whether or not to add the cluster creator (the identity used by Terraform) as an administrator via access entry | `bool` | `false` | no |
439440
| <a name="input_enable_efa_support"></a> [enable\_efa\_support](#input\_enable\_efa\_support) | Determines whether to enable Elastic Fabric Adapter (EFA) support | `bool` | `false` | no |
440441
| <a name="input_enable_irsa"></a> [enable\_irsa](#input\_enable\_irsa) | Determines whether to create an OpenID Connect Provider for EKS to enable IRSA | `bool` | `true` | no |
441442
| <a name="input_enable_kms_key_rotation"></a> [enable\_kms\_key\_rotation](#input\_enable\_kms\_key\_rotation) | Specifies whether key rotation is enabled | `bool` | `true` | no |
442-
| <a name="input_enable_node_custom_tags_permissions"></a> [enable\_node\_custom\_tags\_permissions](#input\_enable\_node\_custom\_tags\_permissions) | Determines whether to enable permissions for custom tags for the EKS Auto node IAM role | `bool` | `true` | no |
443443
| <a name="input_enable_security_groups_for_pods"></a> [enable\_security\_groups\_for\_pods](#input\_enable\_security\_groups\_for\_pods) | Determines whether to add the necessary IAM permission policy for security groups for pods | `bool` | `true` | no |
444444
| <a name="input_fargate_profile_defaults"></a> [fargate\_profile\_defaults](#input\_fargate\_profile\_defaults) | Map of Fargate Profile default configurations | `any` | `{}` | no |
445445
| <a name="input_fargate_profiles"></a> [fargate\_profiles](#input\_fargate\_profiles) | Map of Fargate Profile definitions to create | `any` | `{}` | no |
@@ -467,7 +467,6 @@ We are grateful to the community for contributing bugfixes and improvements! Ple
467467
| <a name="input_node_iam_role_name"></a> [node\_iam\_role\_name](#input\_node\_iam\_role\_name) | Name to use on the EKS Auto node IAM role created | `string` | `null` | no |
468468
| <a name="input_node_iam_role_path"></a> [node\_iam\_role\_path](#input\_node\_iam\_role\_path) | The EKS Auto node IAM role path | `string` | `null` | no |
469469
| <a name="input_node_iam_role_permissions_boundary"></a> [node\_iam\_role\_permissions\_boundary](#input\_node\_iam\_role\_permissions\_boundary) | ARN of the policy that is used to set the permissions boundary for the EKS Auto node IAM role | `string` | `null` | no |
470-
| <a name="input_node_iam_role_policy_statements"></a> [node\_iam\_role\_policy\_statements](#input\_node\_iam\_role\_policy\_statements) | A list of IAM policy [statements](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document#statement) - used for adding specific IAM permissions as needed | `any` | `[]` | no |
471470
| <a name="input_node_iam_role_tags"></a> [node\_iam\_role\_tags](#input\_node\_iam\_role\_tags) | A map of additional tags to add to the EKS Auto node IAM role created | `map(string)` | `{}` | no |
472471
| <a name="input_node_iam_role_use_name_prefix"></a> [node\_iam\_role\_use\_name\_prefix](#input\_node\_iam\_role\_use\_name\_prefix) | Determines whether the EKS Auto node IAM role name (`node_iam_role_name`) is used as a prefix | `bool` | `true` | no |
473472
| <a name="input_node_security_group_additional_rules"></a> [node\_security\_group\_additional\_rules](#input\_node\_security\_group\_additional\_rules) | List of additional security group rules to add to the node security group created. Set `source_cluster_security_group = true` inside rules to set the `cluster_security_group` as source | `any` | `{}` | no |

‎main.tf

Lines changed: 154 additions & 156 deletions
Original file line numberDiff line numberDiff line change
@@ -563,6 +563,160 @@ resource "aws_iam_policy" "cluster_encryption" {
563563
tags = merge(var.tags, var.cluster_encryption_policy_tags)
564564
}
565565

566+
data "aws_iam_policy_document" "custom" {
567+
count = local.create_iam_role && var.enable_auto_mode_custom_tags ? 1 : 0
568+
569+
dynamic "statement" {
570+
for_each = var.enable_auto_mode_custom_tags ? [1] : []
571+
572+
content {
573+
sid = "Compute"
574+
actions = [
575+
"ec2:CreateFleet",
576+
"ec2:RunInstances",
577+
"ec2:CreateLaunchTemplate",
578+
]
579+
resources = ["*"]
580+
581+
condition {
582+
test = "StringEquals"
583+
variable = "aws:RequestTag/eks:eks-cluster-name"
584+
values = ["$${aws:PrincipalTag/eks:eks-cluster-name}"]
585+
}
586+
587+
condition {
588+
test = "StringLike"
589+
variable = "aws:RequestTag/eks:kubernetes-node-class-name"
590+
values = ["*"]
591+
}
592+
593+
condition {
594+
test = "StringLike"
595+
variable = "aws:RequestTag/eks:kubernetes-node-pool-name"
596+
values = ["*"]
597+
}
598+
}
599+
}
600+
601+
dynamic "statement" {
602+
for_each = var.enable_auto_mode_custom_tags ? [1] : []
603+
604+
content {
605+
sid = "Storage"
606+
actions = [
607+
"ec2:CreateVolume",
608+
"ec2:CreateSnapshot",
609+
]
610+
resources = [
611+
"arn:${local.partition}:ec2:*:*:volume/*",
612+
"arn:${local.partition}:ec2:*:*:snapshot/*",
613+
]
614+
615+
condition {
616+
test = "StringEquals"
617+
variable = "aws:RequestTag/eks:eks-cluster-name"
618+
values = ["$${aws:PrincipalTag/eks:eks-cluster-name}"]
619+
}
620+
}
621+
}
622+
623+
dynamic "statement" {
624+
for_each = var.enable_auto_mode_custom_tags ? [1] : []
625+
626+
content {
627+
sid = "Networking"
628+
actions = ["ec2:CreateNetworkInterface"]
629+
resources = ["*"]
630+
631+
condition {
632+
test = "StringEquals"
633+
variable = "aws:RequestTag/eks:eks-cluster-name"
634+
values = ["$${aws:PrincipalTag/eks:eks-cluster-name}"]
635+
}
636+
637+
condition {
638+
test = "StringEquals"
639+
variable = "aws:RequestTag/eks:kubernetes-cni-node-name"
640+
values = ["*"]
641+
}
642+
}
643+
}
644+
645+
dynamic "statement" {
646+
for_each = var.enable_auto_mode_custom_tags ? [1] : []
647+
648+
content {
649+
sid = "LoadBalancer"
650+
actions = [
651+
"elasticloadbalancing:CreateLoadBalancer",
652+
"elasticloadbalancing:CreateTargetGroup",
653+
"elasticloadbalancing:CreateListener",
654+
"elasticloadbalancing:CreateRule",
655+
"ec2:CreateSecurityGroup",
656+
]
657+
resources = ["*"]
658+
659+
condition {
660+
test = "StringEquals"
661+
variable = "aws:RequestTag/eks:eks-cluster-name"
662+
values = ["$${aws:PrincipalTag/eks:eks-cluster-name}"]
663+
}
664+
}
665+
}
666+
667+
dynamic "statement" {
668+
for_each = var.enable_auto_mode_custom_tags ? [1] : []
669+
670+
content {
671+
sid = "ShieldProtection"
672+
actions = ["shield:CreateProtection"]
673+
resources = ["*"]
674+
675+
condition {
676+
test = "StringEquals"
677+
variable = "aws:RequestTag/eks:eks-cluster-name"
678+
values = ["$${aws:PrincipalTag/eks:eks-cluster-name}"]
679+
}
680+
}
681+
}
682+
683+
dynamic "statement" {
684+
for_each = var.enable_auto_mode_custom_tags ? [1] : []
685+
686+
content {
687+
sid = "ShieldTagResource"
688+
actions = ["shield:TagResource"]
689+
resources = ["arn:${local.partition}:shield::*:protection/*"]
690+
691+
condition {
692+
test = "StringEquals"
693+
variable = "aws:RequestTag/eks:eks-cluster-name"
694+
values = ["$${aws:PrincipalTag/eks:eks-cluster-name}"]
695+
}
696+
}
697+
}
698+
}
699+
700+
resource "aws_iam_policy" "custom" {
701+
count = local.create_iam_role && var.enable_auto_mode_custom_tags ? 1 : 0
702+
703+
name = var.iam_role_use_name_prefix ? null : local.iam_role_name
704+
name_prefix = var.iam_role_use_name_prefix ? "${local.iam_role_name}-" : null
705+
path = var.iam_role_path
706+
description = var.iam_role_description
707+
708+
policy = data.aws_iam_policy_document.custom[0].json
709+
710+
tags = merge(var.tags, var.iam_role_tags)
711+
}
712+
713+
resource "aws_iam_role_policy_attachment" "custom" {
714+
count = local.create_iam_role && var.enable_auto_mode_custom_tags ? 1 : 0
715+
716+
policy_arn = aws_iam_policy.custom[0].arn
717+
role = aws_iam_role.this[0].name
718+
}
719+
566720
################################################################################
567721
# EKS Addons
568722
################################################################################
@@ -696,8 +850,6 @@ resource "aws_eks_identity_provider_config" "this" {
696850
locals {
697851
create_node_iam_role = local.create && var.create_node_iam_role && local.auto_mode_enabled
698852
node_iam_role_name = coalesce(var.node_iam_role_name, "${var.cluster_name}-eks-auto")
699-
700-
create_node_iam_role_custom_policy = local.create_node_iam_role && (var.enable_node_custom_tags_permissions || length(var.node_iam_role_policy_statements) > 0)
701853
}
702854

703855
data "aws_iam_policy_document" "node_assume_role_policy" {
@@ -749,157 +901,3 @@ resource "aws_iam_role_policy_attachment" "eks_auto_additional" {
749901
policy_arn = each.value
750902
role = aws_iam_role.eks_auto[0].name
751903
}
752-
753-
resource "aws_iam_role_policy_attachment" "eks_auto_custom" {
754-
count = local.create_node_iam_role_custom_policy ? 1 : 0
755-
756-
policy_arn = aws_iam_policy.eks_auto_custom[0].arn
757-
role = aws_iam_role.eks_auto[0].name
758-
}
759-
760-
data "aws_iam_policy_document" "eks_auto_custom" {
761-
count = local.create_node_iam_role_custom_policy ? 1 : 0
762-
763-
dynamic "statement" {
764-
for_each = var.enable_node_custom_tags_permissions ? [1] : []
765-
766-
content {
767-
sid = "Compute"
768-
actions = [
769-
"ec2:CreateFleet",
770-
"ec2:RunInstances",
771-
"ec2:CreateLaunchTemplate",
772-
]
773-
resources = ["*"]
774-
775-
condition {
776-
test = "StringEquals"
777-
variable = "aws:RequestTag/eks:eks-cluster-name"
778-
values = ["$${aws:PrincipalTag/eks:eks-cluster-name}"]
779-
}
780-
781-
condition {
782-
test = "StringLike"
783-
variable = "aws:RequestTag/eks:kubernetes-node-class-name"
784-
values = ["*"]
785-
}
786-
787-
condition {
788-
test = "StringLike"
789-
variable = "aws:RequestTag/eks:kubernetes-node-pool-name"
790-
values = ["*"]
791-
}
792-
}
793-
}
794-
795-
dynamic "statement" {
796-
for_each = var.enable_node_custom_tags_permissions ? [1] : []
797-
798-
content {
799-
sid = "Storage"
800-
actions = [
801-
"ec2:CreateVolume",
802-
"ec2:CreateSnapshot",
803-
]
804-
resources = [
805-
"arn:${local.partition}:ec2:*:*:volume/*",
806-
"arn:${local.partition}:ec2:*:*:snapshot/*",
807-
]
808-
809-
condition {
810-
test = "StringEquals"
811-
variable = "aws:RequestTag/eks:eks-cluster-name"
812-
values = ["$${aws:PrincipalTag/eks:eks-cluster-name}"]
813-
}
814-
}
815-
}
816-
817-
dynamic "statement" {
818-
for_each = var.enable_node_custom_tags_permissions ? [1] : []
819-
820-
content {
821-
sid = "Networking"
822-
actions = ["ec2:CreateNetworkInterface"]
823-
resources = ["*"]
824-
825-
condition {
826-
test = "StringEquals"
827-
variable = "aws:RequestTag/eks:eks-cluster-name"
828-
values = ["$${aws:PrincipalTag/eks:eks-cluster-name}"]
829-
}
830-
831-
condition {
832-
test = "StringEquals"
833-
variable = "aws:RequestTag/eks:kubernetes-cni-node-name"
834-
values = ["*"]
835-
}
836-
}
837-
}
838-
839-
dynamic "statement" {
840-
for_each = var.enable_node_custom_tags_permissions ? [1] : []
841-
842-
content {
843-
sid = "LoadBalancer"
844-
actions = [
845-
"elasticloadbalancing:CreateLoadBalancer",
846-
"elasticloadbalancing:CreateTargetGroup",
847-
"elasticloadbalancing:CreateListener",
848-
"elasticloadbalancing:CreateRule",
849-
"ec2:CreateSecurityGroup",
850-
]
851-
resources = ["*"]
852-
853-
condition {
854-
test = "StringEquals"
855-
variable = "aws:RequestTag/eks:eks-cluster-name"
856-
values = ["$${aws:PrincipalTag/eks:eks-cluster-name}"]
857-
}
858-
}
859-
}
860-
861-
dynamic "statement" {
862-
for_each = var.enable_node_custom_tags_permissions ? [1] : []
863-
864-
content {
865-
sid = "ShieldProtection"
866-
actions = ["shield:CreateProtection"]
867-
resources = ["*"]
868-
869-
condition {
870-
test = "StringEquals"
871-
variable = "aws:RequestTag/eks:eks-cluster-name"
872-
values = ["$${aws:PrincipalTag/eks:eks-cluster-name}"]
873-
}
874-
}
875-
}
876-
877-
dynamic "statement" {
878-
for_each = var.enable_node_custom_tags_permissions ? [1] : []
879-
880-
content {
881-
sid = "ShieldTagResource"
882-
actions = ["shield:TagResource"]
883-
resources = ["arn:${local.partition}:shield::*:protection/*"]
884-
885-
condition {
886-
test = "StringEquals"
887-
variable = "aws:RequestTag/eks:eks-cluster-name"
888-
values = ["$${aws:PrincipalTag/eks:eks-cluster-name}"]
889-
}
890-
}
891-
}
892-
}
893-
894-
resource "aws_iam_policy" "eks_auto_custom" {
895-
count = local.create_node_iam_role_custom_policy ? 1 : 0
896-
897-
name = var.node_iam_role_use_name_prefix ? null : local.node_iam_role_name
898-
name_prefix = var.node_iam_role_use_name_prefix ? "${local.node_iam_role_name}-" : null
899-
path = var.node_iam_role_path
900-
description = var.node_iam_role_description
901-
902-
policy = data.aws_iam_policy_document.eks_auto_custom[0].json
903-
904-
tags = merge(var.tags, var.node_iam_role_tags)
905-
}

0 commit comments

Comments
 (0)