Skip to content
Jump to bottom

🐛 fix(access_entries): update regex so -route53 is excluded #22

Merged
merged 1 commit into from
Sep 13, 2024
Merged

🐛 fix(access_entries): update regex so -route53 is excluded #22

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
11 changes: 5 additions & 6 deletions access_entries.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@ data "aws_iam_roles" "sso_admins" {
}

data "aws_iam_roles" "roles" {
name_regex = "r-inf-terrafor(m|m-eks)"
name_regex = "r-inf-terraform(-eks)"
}

data "aws_iam_roles" "sso_read" {
Expand All @@ -21,31 +21,30 @@ data "aws_iam_roles" "sso_read" {

locals {
access_entries = merge(local.admins, local.viewers)
arns = [for arn in concat(tolist(data.aws_iam_roles.roles.arns), tolist(data.aws_iam_roles.sso_admins.arns)) : arn if arn != data.aws_iam_session_context.current.issuer_arn]
admin_arns = [for arn in concat(tolist(data.aws_iam_roles.roles.arns), tolist(data.aws_iam_roles.sso_admins.arns)) : arn if arn != data.aws_iam_session_context.current.issuer_arn]
admins = {
for arn in local.arns :
for arn in local.admin_arns :
arn => {
principal_arn = arn
kubernetes_groups = ["eks-console-dashboard-full-access-group"]
policy_associations = {
admin = {
policy_arn = "arn:aws-us-gov:eks::aws:cluster-access-policy/AmazonEKSClusterAdminPolicy"
policy_arn = format("arn:%v:eks::aws:cluster-access-policy/AmazonEKSClusterAdminPolicy", data.aws_arn.current.partition)
access_scope = {
type = "cluster"
}
}
}
}
}

viewers = {
for arn in tolist(data.aws_iam_roles.sso_read.arns) :
arn => {
principal_arn = arn
kubernetes_groups = ["eks-console-dashboard-restricted-access-group"]
policy_associations = {
view = {
policy_arn = "arn:aws-us-gov:eks::aws:cluster-access-policy/AmazonEKSViewPolicy"
policy_arn = format("arn:%v:eks::aws:cluster-access-policy/AmazonEKSViewPolicy", data.aws_arn.current.partition)
access_scope = {
type = "cluster"
}
Expand Down