Readme - terraform-aws-modules/eks-pod-identity (CIS AWS Benchmark v6.0.0)

AWS EKS Pod Identity Terraform module

Terraform module which creates Amazon EKS Pod Identity roles.

Usage

See examples directory for working examples to reference:

Custom IAM Role

You can attach custom permissions/policies in a number of different ways:

module "custom_pod_identity" {
  source = "terraform-aws-modules/eks-pod-identity/aws"

  name = "custom"

  trust_policy_conditions = [
    {
      test     = "StringEquals"
      variable = "aws:PrincipalOrgID"
      values   = ["o-1234567890"]
    }
  ]

  trust_policy_statements = [
    {
      sid       = "Test"
      actions   = ["sts:AssumeRole"]
      resources = ["arn:aws:iam::1234567890:role/Test*"]
    }
  ]

  attach_custom_policy      = true
  source_policy_documents   = [data.aws_iam_policy_document.source.json]
  override_policy_documents = [data.aws_iam_policy_document.override.json]

  policy_statements = [
    {
      sid       = "S3"
      actions   = ["s3:List*"]
      resources = ["*"]
    }
  ]

  additional_policy_arns = {
    AmazonEKS_CNI_Policy = "arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy"
    additional           = aws_iam_policy.additional.arn
  }

  associations = {
    custom-association = {
      cluster_name    = "custom-cluster"
      namespace       = "custom-namespace"
      service_account = "custom-service-account"
    }
  }

  tags = {
    Environment = "dev"
  }
}

AWS Gateway Controller

module "aws_gateway_controller_pod_identity" {
  source = "terraform-aws-modules/eks-pod-identity/aws"

  name = "aws-gateway-controller"

  attach_aws_gateway_controller_policy = true

  associations = {
    this = {
      cluster_name    = "example"
      namespace       = "aws-application-networking-system"
      service_account = "gateway-api-controller"
    }
  }

  tags = {
    Environment = "dev"
  }
}

Cert Manager

module "cert_manager_pod_identity" {
  source = "terraform-aws-modules/eks-pod-identity/aws"

  name = "cert-manager"

  attach_cert_manager_policy    = true
  cert_manager_hosted_zone_arns = ["arn:aws:route53:::hostedzone/IClearlyMadeThisUp"]

  associations = {
    this = {
      cluster_name    = "example"
      namespace       = "cert-manager"
      service_account = "cert-manager"
    }
  }

  tags = {
    Environment = "dev"
  }
}

AWS CloudWatch Observability

module "aws_cloudwatch_observability_pod_identity" {
  source = "terraform-aws-modules/eks-pod-identity/aws"

  name = "aws-cloudwatch-observability"

  attach_aws_cloudwatch_observability_policy = true

  associations = {
    this = {
      cluster_name    = "example"
      namespace       = "amazon-cloudwatch"
      service_account = "cloudwatch-agent"
    }
  }

  tags = {
    Environment = "dev"
  }
}

Cluster Autoscaler

module "cluster_autoscaler_pod_identity" {
  source = "terraform-aws-modules/eks-pod-identity/aws"

  name = "cluster-autoscaler"

  attach_cluster_autoscaler_policy = true
  cluster_autoscaler_cluster_names = ["foo"]

  associations = {
    this = {
      cluster_name    = "example"
      namespace       = "kube-system"
      service_account = "cluster-autoscaler-sa"
    }
  }

  tags = {
    Environment = "dev"
  }
}

AWS EBS CSI Driver

module "aws_ebs_csi_pod_identity" {
  source = "terraform-aws-modules/eks-pod-identity/aws"

  name = "aws-ebs-csi"

  attach_aws_ebs_csi_policy = true
  aws_ebs_csi_kms_arns      = ["arn:aws:kms:*:*:key/1234abcd-12ab-34cd-56ef-1234567890ab"]

  associations = {
    this = {
      cluster_name    = "example"
      namespace       = "kube-system"
      service_account = "ebs-csi-controller-sa"
    }
  }

  tags = {
    Environment = "dev"
  }
}

AWS EFS CSI Driver

module "aws_efs_csi_pod_identity" {
  source = "terraform-aws-modules/eks-pod-identity/aws"

  name = "aws-efs-csi"

  attach_aws_efs_csi_policy = true

  associations = {
    this = {
      cluster_name    = "example"
      namespace       = "kube-system"
      service_account = "efs-csi-controller-sa"
    }
  }

  tags = {
    Environment = "dev"
  }
}

External DNS

module "external_dns_pod_identity" {
  source = "terraform-aws-modules/eks-pod-identity/aws"

  name = "external-dns"

  attach_external_dns_policy    = true
  external_dns_hosted_zone_arns = ["arn:aws:route53:::hostedzone/IClearlyMadeThisUp"]

  associations = {
    this = {
      cluster_name    = "example"
      namespace       = "external-dns"
      service_account = "external-dns-sa"
    }
  }

  tags = {
    Environment = "dev"
  }
}

External Secrets

module "external_secrets_pod_identity" {
  source = "terraform-aws-modules/eks-pod-identity/aws"

  name = "external-secrets"

  attach_external_secrets_policy        = true
  external_secrets_ssm_parameter_arns   = ["arn:aws:ssm:*:*:parameter/foo"]
  external_secrets_secrets_manager_arns = ["arn:aws:secretsmanager:*:*:secret:bar"]
  external_secrets_kms_key_arns         = ["arn:aws:kms:*:*:key/1234abcd-12ab-34cd-56ef-1234567890ab"]
  external_secrets_create_permission    = true

  associations = {
    this = {
      cluster_name    = "example"
      namespace       = "external-secrets"
      service_account = "external-secrets-sa"
    }
  }

  tags = {
    Environment = "dev"
  }
}

AWS FSx for Lustre CSI Driver

module "aws_fsx_lustre_csi_pod_identity" {
  source = "terraform-aws-modules/eks-pod-identity/aws"

  name = "aws-fsx-lustre-csi"

  attach_aws_fsx_lustre_csi_policy     = true
  aws_fsx_lustre_csi_service_role_arns = ["arn:aws:iam::*:role/aws-service-role/s3.data-source.lustre.fsx.amazonaws.com/*"]

  associations = {
    this = {
      cluster_name    = "example"
      namespace       = "kube-system"
      service_account = "fsx-csi-controller-sa"
    }
  }

  tags = {
    Environment = "dev"
  }
}

AWS Load Balancer Controller

module "aws_lb_controller_pod_identity" {
  source = "terraform-aws-modules/eks-pod-identity/aws"

  name = "aws-lbc"

  attach_aws_lb_controller_policy = true

  associations = {
    this = {
      cluster_name    = "example"
      namespace       = "kube-system"
      service_account = "aws-load-balancer-controller-sa"
    }
  }

  tags = {
    Environment = "dev"
  }
}

AWS Load Balancer Controller with Global Accelerator

module "aws_lb_controller_pod_identity" {
  source = "terraform-aws-modules/eks-pod-identity/aws"

  name = "aws-lbc"

  attach_aws_lb_controller_policy                 = true
  attach_aws_global_accelerator_controller_policy = true

  associations = {
    this = {
      cluster_name    = "example"
      namespace       = "kube-system"
      service_account = "aws-load-balancer-controller-sa"
    }
  }

  tags = {
    Environment = "dev"
  }
}

AWS Load Balancer Controller - Target Group Binding Only

module "aws_lb_controller_targetgroup_binding_only_pod_identity" {
  source = "terraform-aws-modules/eks-pod-identity/aws"

  name = "aws-lbc-targetgroup-binding-only"

  attach_aws_lb_controller_targetgroup_binding_only_policy = true
  aws_lb_controller_targetgroup_arns                       = ["arn:aws:elasticloadbalancing:*:*:targetgroup/foo/bar"]

  associations = {
    this = {
      cluster_name    = "example"
      namespace       = "kube-system"
      service_account = "aws-load-balancer-controller-tgb-sa"
    }
  }

  tags = {
    Environment = "dev"
  }
}

AwS AppMesh Controller

module "aws_appmesh_controller_pod_identity" {
  source = "terraform-aws-modules/eks-pod-identity/aws"

  name = "aws-appmesh-controller"

  attach_aws_appmesh_controller_policy = true

  associations = {
    this = {
      cluster_name    = "example"
      namespace       = "appmesh-system"
      service_account = "appmesh-controller"
    }
  }

  tags = {
    Environment = "dev"
  }
}

AwS AppMesh Envoy Proxy

module "aws_appmesh_envoy_proxy_pod_identity" {
  source = "terraform-aws-modules/eks-pod-identity/aws"

  name = "aws-appmesh-envoy-proxy"

  attach_aws_appmesh_envoy_proxy_policy = true

  associations = {
    this = {
      cluster_name    = "example"
      namespace       = "appmesh-system"
      service_account = "envoy-proxy"
    }
  }

  tags = {
    Environment = "dev"
  }
}

Amazon Managed Service for Prometheus

module "amazon_managed_service_prometheus_pod_identity" {
  source = "terraform-aws-modules/eks-pod-identity/aws"

  name = "amazon-managed-service-prometheus"

  attach_amazon_managed_service_prometheus_policy  = true
  amazon_managed_service_prometheus_workspace_arns = ["arn:aws:prometheus:*:*:workspace/foo"]

  associations = {
    this = {
      cluster_name    = "example"
      namespace       = "prometheus"
      service_account = "prometheus"
    }
  }

  tags = {
    Environment = "dev"
  }
}

Mountpoint S3 CSI Driver

module "mountpoint_s3_csi_pod_identity" {
  source = "terraform-aws-modules/eks-pod-identity/aws"

  name = "mountpoint-s3-csi"

  attach_mountpoint_s3_csi_policy    = true
  mountpoint_s3_csi_bucket_arns      = ["arn:aws:s3:::mountpoint-s3"]
  mountpoint_s3_csi_bucket_path_arns = ["arn:aws:s3:::mountpoint-s3/example/*"]

  associations = {
    this = {
      cluster_name    = "example"
      namespace       = "kube-system"
      service_account = "s3-csi-driver-sa"
    }
  }

  tags = {
    Environment = "dev"
  }
}

AWS Node Termination Handler

module "aws_node_termination_handler_pod_identity" {
  source = "terraform-aws-modules/eks-pod-identity/aws"

  name = "aws-node-termination-handler"

  attach_aws_node_termination_handler_policy  = true
  aws_node_termination_handler_sqs_queue_arns = ["arn:aws:sqs:*:*:eks-node-termination-handler"]

  associations = {
    this = {
      cluster_name    = "example"
      namespace       = "aws-node-termination-handler"
      service_account = "aws-node-termination-handler-sa"
    }
  }

  tags = {
    Environment = "dev"
  }
}

AWS Private CA Issuer

module "aws_privateca_issuer_pod_identity" {
  source = "terraform-aws-modules/eks-pod-identity/aws"

  name = "aws-privateca-issuer"

  attach_aws_privateca_issuer_policy = true
  aws_privateca_issuer_acmca_arns    = ["arn:aws:acm-pca:*:*:certificate-authority/foo"]

  associations = {
    this = {
      cluster_name    = "example"
      namespace       = "cert-manager"
      service_account = "aws-privateca-issuer-sa"
    }
  }

  tags = {
    Environment = "dev"
  }
}

PGAnalyze

module "pganalyze_pod_identity" {
  source = "terraform-aws-modules/eks-pod-identity/aws"

  name = "pganalyze"

  attach_pganalyze_pod_identity_policy = true

  associations = {
    this = {
      cluster_name    = "example"
      namespace       = "default"
      service_account = "pganalyze-service-account"
    }
  }

  tags = {
    Environment = "dev"
  }
}

Velero

module "velero_pod_identity" {
  source = "terraform-aws-modules/eks-pod-identity/aws"

  name = "velero"

  attach_velero_policy       = true
  velero_s3_bucket_arns      = ["arn:aws:s3:::velero-backups"]
  velero_s3_bucket_path_arns = ["arn:aws:s3:::velero-backups/example/*"]

  associations = {
    this = {
      cluster_name    = "example"
      namespace       = "velero"
      service_account = "velero-server"
    }
  }

  tags = {
    Environment = "dev"
  }
}

AWS VPC CNI - IPv4

module "aws_vpc_cni_ipv4_pod_identity" {
  source = "terraform-aws-modules/eks-pod-identity/aws"

  name = "aws-vpc-cni-ipv4"

  attach_aws_vpc_cni_policy = true
  aws_vpc_cni_enable_ipv4   = true

  associations = {
    this = {
      cluster_name    = "example"
      namespace       = "kube-system"
      service_account = "aws-node"
    }
  }

  tags = {
    Environment = "dev"
  }
}

AWS VPC CNI - IPv6

module "aws_vpc_cni_ipv6_pod_identity" {
  source = "terraform-aws-modules/eks-pod-identity/aws"

  name = "aws-vpc-cni-ipv6"

  attach_aws_vpc_cni_policy = true
  aws_vpc_cni_enable_ipv6   = true

  associations = {
    this = {
      cluster_name    = "example"
      namespace       = "kube-system"
      service_account = "aws-node"
    }
  }

  tags = {
    Environment = "dev"
  }
}

Examples codified under the examples are intended to give users references for how to use the module(s) as well as testing/validating changes to the source code of the module. If contributing to the project, please be sure to make any appropriate updates to the relevant examples to allow maintainers to test your changes and to keep the examples up to date for users. Thank you!

Complete

License

Apache-2.0 Licensed. See LICENSE.