From f618e618e639dd8fe4aff438366cf94103d3953c Mon Sep 17 00:00:00 2001
From: "Matthew C. Morgan" <matthew.c.morgan@census.gov>
Date: Tue, 20 Jan 2026 15:06:03 -0500
Subject: [PATCH] chore(service-linked-roles) add var and count to gate
 creation of spot role

---
 README.md    |  2 ++
 main.tf      | 27 ++++++++++++++-------------
 variables.tf |  6 ++++++
 3 files changed, 22 insertions(+), 13 deletions(-)

diff --git a/README.md b/README.md
index 3dff98b..e40241c 100644
--- a/README.md
+++ b/README.md
@@ -42,6 +42,7 @@ The module deploys Karpenter needed AWS resources, namely in IAM. It copies the
 
 | Name | Type |
 |------|------|
+| [aws_iam_service_linked_role.spot](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_service_linked_role) | resource |
 | [helm_release.karpenter](https://registry.terraform.io/providers/hashicorp/helm/latest/docs/resources/release) | resource |
 | [helm_release.nodepool_resources](https://registry.terraform.io/providers/hashicorp/helm/latest/docs/resources/release) | resource |
 | [null_resource.git_version](https://registry.terraform.io/providers/hashicorp/null/latest/docs/resources/resource) | resource |
@@ -58,6 +59,7 @@ The module deploys Karpenter needed AWS resources, namely in IAM. It copies the
 | <a name="input_account_id"></a> [account\_id](#input\_account\_id) | aws account number | `string` | `""` | no |
 | <a name="input_cluster_endpoint"></a> [cluster\_endpoint](#input\_cluster\_endpoint) | Endpoint for your Kubernetes API server | `string` | n/a | yes |
 | <a name="input_cluster_name"></a> [cluster\_name](#input\_cluster\_name) | EKS cluster name name component used through out the EKS cluster describing its purpose (ex: dice-dev) | `string` | n/a | yes |
+| <a name="input_create_spot_service_linked_role"></a> [create\_spot\_service\_linked\_role](#input\_create\_spot\_service\_linked\_role) | Whether to create the service-linked role for EC2 Spot (required for Karpenter spot instances) | `bool` | `false` | no |
 | <a name="input_eecr_info"></a> [eecr\_info](#input\_eecr\_info) | Enterprise ECR source information | <pre>object({<br/>    account_id = string<br/>    alias      = string<br/>    profile    = string<br/>    region     = string<br/>  })</pre> | <pre>{<br/>  "account_id": "269222635945",<br/>  "alias": "lab-gov-shared-nonprod",<br/>  "profile": "269222635945-lab-gov-shared-nonprod",<br/>  "region": "us-gov-east-1"<br/>}</pre> | no |
 | <a name="input_karpenter_helm_chart"></a> [karpenter\_helm\_chart](#input\_karpenter\_helm\_chart) | Which helm chart of karpenter | `string` | `"1.1.1"` | no |
 | <a name="input_karpenter_helm_repo"></a> [karpenter\_helm\_repo](#input\_karpenter\_helm\_repo) | Helm repo for official karpenter chart | `string` | `"oci://public.ecr.aws/karpenter"` | no |
diff --git a/main.tf b/main.tf
index a3fa351..acd95a6 100644
--- a/main.tf
+++ b/main.tf
@@ -56,7 +56,7 @@ data "aws_ecr_image" "karpenter_image" {
 resource "helm_release" "karpenter" {
   depends_on = [
     data.aws_ecr_image.karpenter_image,
-    # aws_iam_service_linked_role.spot
+    aws_iam_service_linked_role.spot
   ]
   name             = "karpenter"
   chart            = "karpenter"
@@ -113,15 +113,16 @@ resource "helm_release" "nodepool_resources" {
 }
 
 # Create service-linked role for EC2 Spot (required for Karpenter spot instances)
-# resource "aws_iam_service_linked_role" "spot" {
-#   aws_service_name = "spot.amazonaws.com"
-#   description      = "Service-linked role for EC2 Spot instances used by Karpenter"
-
-#   # This will only create the role if it doesn't already exist
-#   # If it exists, Terraform will import the existing role
-#   lifecycle {
-#     ignore_changes = [
-#       description,
-#     ]
-#   }
-# }
+resource "aws_iam_service_linked_role" "spot" {
+  count            = var.create_spot_service_linked_role ? 1 : 0
+  aws_service_name = "spot.amazonaws.com"
+  description      = "Service-linked role for EC2 Spot instances used by Karpenter"
+
+  # This will only create the role if it doesn't already exist
+  # If it exists, Terraform will import the existing role
+  lifecycle {
+    ignore_changes = [
+      description,
+    ]
+  }
+}
diff --git a/variables.tf b/variables.tf
index 8a23f33..d2bb162 100644
--- a/variables.tf
+++ b/variables.tf
@@ -91,3 +91,9 @@ variable "tags" {
   type        = map(string)
   default     = {}
 }
+
+variable "create_spot_service_linked_role" {
+  description = "Whether to create the service-linked role for EC2 Spot (required for Karpenter spot instances)"
+  type        = bool
+  default     = false
+}