feat: Update Hybrid Node IAM role permissions (#3620)

SCT-Engineering · Jan 5, 2026 · 60dcc45 · 60dcc45
1 parent c41b582
commit 60dcc45
Show file tree

Hide file tree

Showing 2 changed files with 35 additions and 8 deletions.
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
@@ -1,6 +1,6 @@
 repos:
   - repo: https://github.com/antonbabenko/pre-commit-terraform
-    rev: v1.104.0
+    rev: v1.104.1
     hooks:
       - id: terraform_fmt
       - id: terraform_docs

diff --git a/modules/hybrid-node-role/main.tf b/modules/hybrid-node-role/main.tf
@@ -93,17 +93,44 @@ resource "aws_iam_role" "this" {
 data "aws_iam_policy_document" "this" {
   count = var.create ? 1 : 0
 
-  statement {
-    actions = [
-      "ssm:DeregisterManagedInstance",
-      "ssm:DescribeInstanceInformation",
-    ]
+  dynamic "statement" {
+    for_each = var.enable_ira ? [] : [1]
+
+    content {
+      sid       = "AllowDeregisterOwnInstance"
+      actions   = ["ssm:DeregisterManagedInstance"]
+      resources = ["arn:${local.partition}:ssm:*:*:managed-instance/*"]
+
+      condition {
+        test     = "ArnLike"
+        variable = "ssm:SourceInstanceARN"
+        values   = ["arn:${local.partition}:ssm:*:*:managed-instance/*"]
+      }
+    }
+  }
 
-    resources = ["*"]
+  dynamic "statement" {
+    for_each = var.enable_ira ? [] : [1]
+
+    content {
+      sid       = "AllowDescribeInstances"
+      actions   = ["ssm:DescribeInstanceInformation"]
+      resources = ["*"]
+
+      condition {
+        test     = "ArnLike"
+        variable = "ssm:SourceInstanceARN"
+        values   = ["arn:${local.partition}:ssm:*:*:managed-instance/*"]
+      }
+    }
   }
 
   statement {
-    actions   = ["eks:DescribeCluster"]
+    sid = "DescribeEKSCluster"
+    actions = [
+      "eks:DescribeCluster",
+      "eks:ListAccessEntries",
+    ]
     resources = var.cluster_arns
   }