Skip to content

Commit

Permalink
remove cross account resources
Browse files Browse the repository at this point in the history
  • Loading branch information
@jamesgreen-moj
jamesgreen-moj committed Nov 14, 2023
1 parent f92b675 commit 1c0df82
Showing 1 changed file with 0 additions and 154 deletions.
154 changes: 0 additions & 154 deletions modules/eks/iam.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -416,157 +416,3 @@ resource "aws_iam_role_policy_attachment" "cloudwatch_exporter_IAMPolicy" {
policy_arn = aws_iam_policy.cloudwatch_exporter_iam_policy.arn
role = aws_iam_role.cloudwatch_exporter.name
}

# Prepare a policy document that can be used by iam roles created in other aws accounts that allow cloudwatch exporter to assume the roles

data "aws_iam_policy_document" "cloudwatch_exporter_assume_role_policy_other_aws_accounts" {
statement {
actions = ["sts:AssumeRole"]
effect = "Allow"

principals {
identifiers = [aws_iam_role.cloudwatch_exporter.arn]
type = "AWS"
}
}
}

# IAM role for Cloudwatch Exporter in development aws account

#resource "aws_iam_role" "cloudwatch_exporter_development" {
# count = terraform.workspace == "development" ? 0 : 1
# assume_role_policy = data.aws_iam_policy_document.cloudwatch_exporter_assume_role_policy_other_aws_accounts.json
# name = "${var.prefix}-CloudwatchExporter"
#
# tags = var.tags
#
# provider = aws.development
#}

#resource "aws_iam_policy" "cloudwatch_exporter_iam_policy_development" {
# count = terraform.workspace == "development" ? 0 : 1
# name = "${var.prefix}-CloudwatchExporterIAMPolicy"
# path = "/"
# description = "IAM role policy for Cloudwatch Exporter in EKS Cluster for ${var.prefix}"
#
# policy = data.template_file.cloudwatch_exporter_iam_policy.rendered
#
# tags = var.tags
#
# provider = aws.development
#}

#resource "aws_iam_role_policy_attachment" "cloudwatch_exporter_IAMPolicy_development" {
# count = terraform.workspace == "development" ? 0 : 1
# policy_arn = aws_iam_policy.cloudwatch_exporter_iam_policy_development[0].arn
# role = aws_iam_role.cloudwatch_exporter_development[0].name
#
# provider = aws.development
#}

#resource "aws_iam_policy" "development_cloudwatch_exporter_role_allow_assume_policy" {
# count = terraform.workspace == "development" ? 0 : 1
# name = "development_cloudwatch_exporter_role_allow_assume_policy"
# path = "/"
# description = "Policy that allows cloudwatch exporter in EKS Cluster for ${var.prefix} to assume role in development AWS account"
#
# policy = <<POLICY
#{
# "Version": "2012-10-17",
# "Statement": [
# {
# "Sid": "Statement",
# "Effect": "Allow",
# "Action": "sts:AssumeRole",
# "Resource": [
# "${aws_iam_role.cloudwatch_exporter_development[0].arn}"
# ]
# }
# ]
#}
#POLICY
#
# depends_on = [
# aws_iam_role.cloudwatch_exporter_development
# ]
#}

#resource "aws_iam_role_policy_attachment" "development_cloudwatch_exporter_allow_assume_IAMPolicy" {
# count = terraform.workspace == "development" ? 0 : 1
# policy_arn = aws_iam_policy.development_cloudwatch_exporter_role_allow_assume_policy[0].arn
# role = aws_iam_role.cloudwatch_exporter.name
#
# depends_on = [
# aws_iam_policy.development_cloudwatch_exporter_role_allow_assume_policy
# ]
#}

# IAM role for Cloudwatch Exporter in pre-production AWS account

#resource "aws_iam_role" "cloudwatch_exporter_pre_production" {
# count = terraform.workspace == "pre-production" ? 0 : 1
# assume_role_policy = data.aws_iam_policy_document.cloudwatch_exporter_assume_role_policy_other_aws_accounts.json
# name = "${var.prefix}-CloudwatchExporter"
#
# tags = var.tags
#
# provider = aws.pre_production
#}

#resource "aws_iam_policy" "cloudwatch_exporter_iam_policy_pre_production" {
# count = terraform.workspace == "pre-production" ? 0 : 1
# name = "${var.prefix}-CloudwatchExporterIAMPolicy"
# path = "/"
# description = "IAM role policy for Cloudwatch Exporter in EKS Cluster for ${var.prefix}"
#
# policy = data.template_file.cloudwatch_exporter_iam_policy.rendered
#
# tags = var.tags
#
# provider = aws.pre_production
#}

#resource "aws_iam_role_policy_attachment" "cloudwatch_exporter_IAMPolicy_pre_production" {
# count = terraform.workspace == "pre-production" ? 0 : 1
# policy_arn = aws_iam_policy.cloudwatch_exporter_iam_policy_pre_production[0].arn
# role = aws_iam_role.cloudwatch_exporter_pre_production[0].name
#
# provider = aws.pre_production
#}

#resource "aws_iam_policy" "pre_production_cloudwatch_exporter_role_allow_assume_policy" {
# count = terraform.workspace == "pre-production" ? 0 : 1
# name = "pre_production_cloudwatch_exporter_role_allow_assume_policy"
# path = "/"
# description = "Policy that allows cloudwatch exporter in EKS Cluster for ${var.prefix} to assume role in pre-production AWS account"
#
# policy = <<POLICY
#{
# "Version": "2012-10-17",
# "Statement": [
# {
# "Sid": "Statement",
# "Effect": "Allow",
# "Action": "sts:AssumeRole",
# "Resource": [
# "${aws_iam_role.cloudwatch_exporter_pre_production[0].arn}"
# ]
# }
# ]
#}
#POLICY
#
# depends_on = [
# aws_iam_role.cloudwatch_exporter_pre_production
# ]
#}

#resource "aws_iam_role_policy_attachment" "pre_production_cloudwatch_exporter_allow_assume_IAMPolicy" {
# count = terraform.workspace == "pre-production" ? 0 : 1
# policy_arn = aws_iam_policy.pre_production_cloudwatch_exporter_role_allow_assume_policy[0].arn
# role = aws_iam_role.cloudwatch_exporter.name
#
# depends_on = [
# aws_iam_policy.pre_production_cloudwatch_exporter_role_allow_assume_policy
# ]
#}

0 comments on commit 1c0df82

Please sign in to comment.