Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Cherry pick of bug fix for manage IAM from on account #244

Merged
merged 2 commits into from
Jan 12, 2024
Merged

Cherry pick of bug fix for manage IAM from on account #244

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
0cdcc59
Cherry pick of bug fix for manage IAM from on account
Jan 12, 2024
4a2cd95
Commit changes made by code formatters
github-actions[bot] Jan 12, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 14 additions & 10 deletions modules/eks/iam.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,7 @@
locals {
is_production = terraform.workspace == "production" ? true : false
}

# IAM Role for the EKS cluster

resource "aws_iam_role" "cluster" {
Expand Down Expand Up @@ -434,7 +438,7 @@ data "aws_iam_policy_document" "cloudwatch_exporter_assume_role_policy_other_aws
# IAM role for Cloudwatch Exporter in development aws account

resource "aws_iam_role" "cloudwatch_exporter_development" {
count = terraform.workspace == "development" ? 0 : 1
count = local.is_production ? 1 : 0
assume_role_policy = data.aws_iam_policy_document.cloudwatch_exporter_assume_role_policy_other_aws_accounts.json
name = "${var.prefix}-CloudwatchExporter"

Expand All @@ -444,7 +448,7 @@ resource "aws_iam_role" "cloudwatch_exporter_development" {
}

resource "aws_iam_policy" "cloudwatch_exporter_iam_policy_development" {
count = terraform.workspace == "development" ? 0 : 1
count = local.is_production ? 1 : 0
name = "${var.prefix}-CloudwatchExporterIAMPolicy"
path = "/"
description = "IAM role policy for Cloudwatch Exporter in EKS Cluster for ${var.prefix}"
Expand All @@ -457,15 +461,15 @@ resource "aws_iam_policy" "cloudwatch_exporter_iam_policy_development" {
}

resource "aws_iam_role_policy_attachment" "cloudwatch_exporter_IAMPolicy_development" {
count = terraform.workspace == "development" ? 0 : 1
count = local.is_production ? 1 : 0
policy_arn = aws_iam_policy.cloudwatch_exporter_iam_policy_development[0].arn
role = aws_iam_role.cloudwatch_exporter_development[0].name

provider = aws.development
}

resource "aws_iam_policy" "development_cloudwatch_exporter_role_allow_assume_policy" {
count = terraform.workspace == "development" ? 0 : 1
count = local.is_production ? 1 : 0
name = "development_cloudwatch_exporter_role_allow_assume_policy"
path = "/"
description = "Policy that allows cloudwatch exporter in EKS Cluster for ${var.prefix} to assume role in development AWS account"
Expand All @@ -492,7 +496,7 @@ POLICY
}

resource "aws_iam_role_policy_attachment" "development_cloudwatch_exporter_allow_assume_IAMPolicy" {
count = terraform.workspace == "development" ? 0 : 1
count = local.is_production ? 1 : 0
policy_arn = aws_iam_policy.development_cloudwatch_exporter_role_allow_assume_policy[0].arn
role = aws_iam_role.cloudwatch_exporter.name

Expand All @@ -504,7 +508,7 @@ resource "aws_iam_role_policy_attachment" "development_cloudwatch_exporter_allow
# IAM role for Cloudwatch Exporter in pre-production AWS account

resource "aws_iam_role" "cloudwatch_exporter_pre_production" {
count = terraform.workspace == "pre-production" ? 0 : 1
count = local.is_production ? 1 : 0
assume_role_policy = data.aws_iam_policy_document.cloudwatch_exporter_assume_role_policy_other_aws_accounts.json
name = "${var.prefix}-CloudwatchExporter"

Expand All @@ -514,7 +518,7 @@ resource "aws_iam_role" "cloudwatch_exporter_pre_production" {
}

resource "aws_iam_policy" "cloudwatch_exporter_iam_policy_pre_production" {
count = terraform.workspace == "pre-production" ? 0 : 1
count = local.is_production ? 1 : 0
name = "${var.prefix}-CloudwatchExporterIAMPolicy"
path = "/"
description = "IAM role policy for Cloudwatch Exporter in EKS Cluster for ${var.prefix}"
Expand All @@ -527,15 +531,15 @@ resource "aws_iam_policy" "cloudwatch_exporter_iam_policy_pre_production" {
}

resource "aws_iam_role_policy_attachment" "cloudwatch_exporter_IAMPolicy_pre_production" {
count = terraform.workspace == "pre-production" ? 0 : 1
count = local.is_production ? 1 : 0
policy_arn = aws_iam_policy.cloudwatch_exporter_iam_policy_pre_production[0].arn
role = aws_iam_role.cloudwatch_exporter_pre_production[0].name

provider = aws.pre_production
}

resource "aws_iam_policy" "pre_production_cloudwatch_exporter_role_allow_assume_policy" {
count = terraform.workspace == "pre-production" ? 0 : 1
count = local.is_production ? 1 : 0
name = "pre_production_cloudwatch_exporter_role_allow_assume_policy"
path = "/"
description = "Policy that allows cloudwatch exporter in EKS Cluster for ${var.prefix} to assume role in pre-production AWS account"
Expand All @@ -562,7 +566,7 @@ POLICY
}

resource "aws_iam_role_policy_attachment" "pre_production_cloudwatch_exporter_allow_assume_IAMPolicy" {
count = terraform.workspace == "pre-production" ? 0 : 1
count = local.is_production ? 1 : 0
policy_arn = aws_iam_policy.pre_production_cloudwatch_exporter_role_allow_assume_policy[0].arn
role = aws_iam_role.cloudwatch_exporter.name

Expand Down
15 changes: 10 additions & 5 deletions modules/vpc/main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,7 @@
locals {
is_production = terraform.workspace == "production" ? true : false
}

module "vpc" {
source = "terraform-aws-modules/vpc/aws"
version = "5.1.1"
Expand All @@ -13,8 +17,10 @@ module "vpc" {
manage_default_network_acl = var.manage_default_network_acl
manage_default_security_group = var.manage_default_security_group
manage_default_route_table = var.manage_default_route_table
reuse_nat_ips = true
external_nat_ip_ids = aws_eip.gw.*.id
reuse_nat_ips = local.is_production
external_nat_ip_ids = local.is_production ? aws_eip.gw.*.id : []
// Lower costs, by lowering availability
single_nat_gateway = local.is_production ? false : true

private_subnets = [for cidr_block in cidrsubnets(var.cidr, 2, 2, 2) : cidrsubnets(cidr_block, 1, 1)[0]]
private_subnet_tags = merge(
Expand All @@ -37,7 +43,6 @@ module "vpc" {
private_route_table_tags = { for k, v in var.tags : k => v if k != "Name" }
public_route_table_tags = { for k, v in var.tags : k => v if k != "Name" }

depends_on = [aws_eip.gw]
}

resource "aws_flow_log" "vpc_flow_log" {
Expand All @@ -48,8 +53,8 @@ resource "aws_flow_log" "vpc_flow_log" {
}

resource "aws_eip" "gw" {
vpc = true
count = length(var.available_zones)
domain = "vpc"
count = terraform.workspace == "development" ? 0 : length(var.available_zones)
public_ipv4_pool = var.byoip_pool_id

tags = var.tags
Expand Down