Skip to content

Commit

Permalink
add roles policies and sg ports
Browse files Browse the repository at this point in the history
  • Loading branch information
morga471 committed Aug 14, 2025
1 parent 0fb8f87 commit 7596baf
Show file tree
Hide file tree
Showing 7 changed files with 348 additions and 6 deletions.
24 changes: 22 additions & 2 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -97,7 +97,7 @@ efs-csi-controller 0 5m
| Name | Version |
|------|---------|
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 0.13 |
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | ~> 5.14 |
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | ~> 5.0 |
| <a name="requirement_null"></a> [null](#requirement\_null) | ~> 3.2 |

## Providers
Expand All @@ -113,16 +113,23 @@ efs-csi-controller 0 5m
| Name | Source | Version |
|------|--------|---------|
| <a name="module_cloudwatch_observability_irsa_role"></a> [cloudwatch\_observability\_irsa\_role](#module\_cloudwatch\_observability\_irsa\_role) | git::https://github.e.it.census.gov/SCT-Engineering/terraform-aws-iam//modules/iam-role-for-service-accounts-eks | n/a |
| <a name="module_cluster"></a> [cluster](#module\_cluster) | git::https://github.e.it.census.gov/SCT-Engineering/terraform-aws-eks/ | v20.36.0 |
| <a name="module_cluster"></a> [cluster](#module\_cluster) | git::https://github.e.it.census.gov/SCT-Engineering/terraform-aws-eks/ | v20.37.2 |
| <a name="module_ebs_csi_irsa_role"></a> [ebs\_csi\_irsa\_role](#module\_ebs\_csi\_irsa\_role) | git::https://github.e.it.census.gov/SCT-Engineering/terraform-aws-iam//modules/iam-role-for-service-accounts-eks | n/a |
| <a name="module_efs_csi_irsa_role"></a> [efs\_csi\_irsa\_role](#module\_efs\_csi\_irsa\_role) | git::https://github.e.it.census.gov/SCT-Engineering/terraform-aws-iam//modules/iam-role-for-service-accounts-eks | n/a |
| <a name="module_role_cluster-admin"></a> [role\_cluster-admin](#module\_role\_cluster-admin) | git@github.e.it.census.gov:terraform-modules/aws-iam-role.git | tf-upgrade |
| <a name="module_role_eks-cluster"></a> [role\_eks-cluster](#module\_role\_eks-cluster) | git@github.e.it.census.gov:terraform-modules/aws-iam-role.git | tf-upgrade |
| <a name="module_role_eks-nodegroup"></a> [role\_eks-nodegroup](#module\_role\_eks-nodegroup) | git@github.e.it.census.gov:terraform-modules/aws-iam-role.git | tf-upgrade |
| <a name="module_vpc_cni_irsa_role"></a> [vpc\_cni\_irsa\_role](#module\_vpc\_cni\_irsa\_role) | git::https://github.e.it.census.gov/SCT-Engineering/terraform-aws-iam//modules/iam-role-for-service-accounts-eks | n/a |

## Resources

| Name | Type |
|------|------|
| [aws_ec2_tag.container_subnets](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ec2_tag) | resource |
| [aws_iam_policy.cloudwatch-policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
| [aws_iam_policy.cluster-admin-policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
| [aws_iam_policy.cluster-admin_assume_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
| [aws_iam_policy.nlb-policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
| [aws_security_group.additional_eks_cluster_sg](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group) | resource |
| [aws_security_group.all_worker_mgmt](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group) | resource |
| [aws_security_group.extra_cluster_sg](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group) | resource |
Expand All @@ -135,11 +142,21 @@ efs-csi-controller 0 5m
| [aws_arn.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/arn) | data source |
| [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |
| [aws_ebs_default_kms_key.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ebs_default_kms_key) | data source |
| [aws_iam_policy.cluster_managed_policies](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy) | data source |
| [aws_iam_policy.nodegroup_managed_policies](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy) | data source |
| [aws_iam_policy_document.allow_sts](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
| [aws_iam_policy_document.cloudwatch-policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
| [aws_iam_policy_document.cluster-admin-policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
| [aws_iam_policy_document.cluster-admin_assume_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
| [aws_iam_policy_document.ec2_assume](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
| [aws_iam_policy_document.eks_assume](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
| [aws_iam_policy_document.nlb-policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
| [aws_iam_roles.roles](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_roles) | data source |
| [aws_iam_roles.sso_admins](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_roles) | data source |
| [aws_iam_roles.sso_read](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_roles) | data source |
| [aws_iam_session_context.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_session_context) | data source |
| [aws_kms_key.ebs_key](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/kms_key) | data source |
| [aws_region.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/region) | data source |
| [aws_subnet.subnets](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/subnet) | data source |
| [aws_subnets.subnets](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/subnets) | data source |
| [aws_vpc.eks_vpc](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/vpc) | data source |
Expand Down Expand Up @@ -203,6 +220,9 @@ efs-csi-controller 0 5m
| <a name="output_node_security_group_id"></a> [node\_security\_group\_id](#output\_node\_security\_group\_id) | ID of the node shared security group |
| <a name="output_oidc_provider"></a> [oidc\_provider](#output\_oidc\_provider) | The OpenID Connect identity provider (issuer URL without leading `https://`) |
| <a name="output_oidc_provider_arn"></a> [oidc\_provider\_arn](#output\_oidc\_provider\_arn) | The ARN of the OIDC Provider if `enable_irsa = true` |
| <a name="output_role_cluster-admin-role_arn"></a> [role\_cluster-admin-role\_arn](#output\_role\_cluster-admin-role\_arn) | Role ARN for EKS Cluster Admin Role |
| <a name="output_role_eks-cluster_arn"></a> [role\_eks-cluster\_arn](#output\_role\_eks-cluster\_arn) | Role ARN for EKS Cluster Role |
| <a name="output_role_eks-nodegroup-role_arn"></a> [role\_eks-nodegroup-role\_arn](#output\_role\_eks-nodegroup-role\_arn) | Role ARN for EKS Cluster Nodegroup Role |
| <a name="output_security_group_all_worker_mgmt_id"></a> [security\_group\_all\_worker\_mgmt\_id](#output\_security\_group\_all\_worker\_mgmt\_id) | The security group to manage all of the worker nodes. |
| <a name="output_self_managed_node_groups"></a> [self\_managed\_node\_groups](#output\_self\_managed\_node\_groups) | Map of attribute maps for all self managed node groups created |
| <a name="output_self_managed_node_groups_autoscaling_group_names"></a> [self\_managed\_node\_groups\_autoscaling\_group\_names](#output\_self\_managed\_node\_groups\_autoscaling\_group\_names) | List of the autoscaling group names created by self-managed node groups |
Expand Down
2 changes: 2 additions & 0 deletions aws_data.tf
Original file line number Diff line number Diff line change
@@ -1,5 +1,7 @@
data "aws_caller_identity" "current" {}

data "aws_region" "current" {}

data "aws_arn" "current" {
arn = data.aws_caller_identity.current.arn
}
Expand Down
2 changes: 1 addition & 1 deletion main.tf
Original file line number Diff line number Diff line change
Expand Up @@ -26,7 +26,7 @@ resource "terraform_data" "subnet_validation" {
}

module "cluster" {
source = "git::https://github.e.it.census.gov/SCT-Engineering/terraform-aws-eks/?ref=v20.36.0"
source = "git::https://github.e.it.census.gov/SCT-Engineering/terraform-aws-eks/?ref=v20.37.2"

access_entries = local.access_entries
cloudwatch_log_group_retention_in_days = var.cloudwatch_retention_days
Expand Down
167 changes: 167 additions & 0 deletions policy.tf
Original file line number Diff line number Diff line change
@@ -0,0 +1,167 @@
resource "aws_iam_policy" "nlb-policy" {
name = format("%v%v-nlb", local.prefixes["eks-policy"], var.cluster_name)
path = "/"
description = "Allow configuration of the ELB"
policy = data.aws_iam_policy_document.nlb-policy.json

}

# Q: why CreateSecurityGroup
# TBD: refine resources to limit only to eks configurations
data "aws_iam_policy_document" "nlb-policy" {
statement {
sid = "EKSNLBConfiguration"
effect = "Allow"
actions = [
"elasticloadbalancing:*",
"ec2:CreateSecurityGroup",
"ec2:Describe*",
]
resources = ["*"]
}
}

resource "aws_iam_policy" "cloudwatch-policy" {
name = format("%v%v-cloudwatch", local.prefixes["eks-policy"], var.cluster_name)
path = "/"
description = "Allow sending metric data to cloudwatch"
policy = data.aws_iam_policy_document.cloudwatch-policy.json

}

# TBD: refine resources to limit only to eks configurations
data "aws_iam_policy_document" "cloudwatch-policy" {
statement {
sid = "EKSCloudwatchMetrics"
effect = "Allow"
actions = [
"cloudwatch:PutMetricData",
]
resources = ["*"]
}
}

#---
# cluster admin policy
#---
resource "aws_iam_policy" "cluster-admin-policy" {
name = format("%v%v-cluster-admin", local.prefixes["eks-policy"], var.cluster_name)
path = "/"
description = "Allow for administration of the cluster ${var.cluster_name} using AWS resources"
policy = data.aws_iam_policy_document.cluster-admin-policy.json

}

data "aws_iam_policy_document" "cluster-admin-policy" {
dynamic "statement" {
for_each = local.admin_policy_statements
iterator = s
content {
sid = format("%v%vAccess", lookup(s.value, "effect", "Allow"), s.key)
effect = lookup(s.value, "effect", "Allow")
actions = lookup(s.value, "actions", [])
resources = lookup(s.value, "resources", [])
}
}
}

locals {
iam_arn = format("arn:%v:iam::%v:%%v", data.aws_arn.current.partition, data.aws_caller_identity.current.account_id)
common_arn = format("arn:%v:%%v:%v:%v:%%v", data.aws_arn.current.partition, data.aws_region.current.name, data.aws_caller_identity.current.account_id)
eks_resources = ["cluster", "addon", "nodegroup", "identityproviderconfig"]

admin_policy_statements = {
ECRRead = {
actions = [
"ecr:Describe*",
"ecr:Get*",
"ecr:ListImages",
"ecr:BatchGetImage",
"ecr:BatchCheckLayerAvailability",
"ecr:GetDownloadUrlForLayer",
]
resources = ["*"]
}
ECRWrite = {
actions = [
"ecr:BatchDeleteImage",
"ecr:CompleteLayerUpload",
"ecr:CreateRepository",
"ecr:DeleteRepository",
"ecr:InitiateLayerUpload",
"ecr:PutImage",
"ecr:UploadLayerPart"
]
resources = [format(local.common_arn, "ecr", format("repository/eks/%v/*", var.cluster_name))]
}
EKSRead = {
actions = [
"eks:ListClusters",
"eks:ListAddons",
"eks:ListNodegroups",
"eks:DescribeCluster",
"eks:DescribeAddon*",
"eks:DescribeNodegroup",
]
resources = [
format(local.common_arn, "eks", "cluster/*"),
format(local.common_arn, "eks", "addon/*"),
format(local.common_arn, "eks", "addons/*"),
format(local.common_arn, "eks", "/addons/*"),
format(local.common_arn, "eks", "nodegroup/*"),
]
}
IAMRead = {
actions = [
"iam:ListRoles",
]
resources = ["*"]
}
SSMGet = {
actions = [
"ssm:GetParameter",
]
resources = [
format("arn:%v:%v:%v:%v:%v", data.aws_arn.current.partition, "ssm", data.aws_region.current.name, "", "parameter/aws/service/eks/*")
]
}
EKSReadMyClusters = {
actions = [
"eks:List*",
"eks:Read*",
"eks:Describe*",
"eks:AccessKubernetesApi",
]
resources = flatten(concat(
[format(local.common_arn, "eks", format("/clusters/%v/addons", var.cluster_name))],
[for r in local.eks_resources : [format(local.common_arn, "eks", format("%v/%v", r, var.cluster_name)),
format(local.common_arn, "eks", format("%v/%v/*", r, var.cluster_name))]]
))
}
}
}


#---
# cluster admin assume policy
#---
resource "aws_iam_policy" "cluster-admin_assume_policy" {
name = format("%v%v-cluster-admin-assume", local.prefixes["eks-policy"], var.cluster_name)
path = "/"
description = "Allow for assume role to the cluster-admin role for ${var.cluster_name}"
policy = data.aws_iam_policy_document.cluster-admin_assume_policy.json

tags = merge(
local.base_tags,
tomap({ "Name" = format("%v%v-cluster-admin-assume", local.prefixes["eks-policy"], var.cluster_name) }),
)
}

data "aws_iam_policy_document" "cluster-admin_assume_policy" {
statement {
sid = "AllowSTSAssumeClusterAdminRole"
effect = "Allow"
actions = ["sts:AssumeRole"]
resources = [module.role_cluster-admin.role_arn]
}
}
2 changes: 1 addition & 1 deletion requirements.tf
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ terraform {
required_providers {
aws = {
source = "hashicorp/aws"
version = "~> 5.14"
version = "~> 5.0"
}
null = {
source = "hashicorp/null"
Expand Down
Loading

0 comments on commit 7596baf

Please sign in to comment.