Customize name of aws_iam_policy.cluster_encryption

[romogo17]

Hi team, in #1915 a new IAM Policy was added that grants the Cluster Role permissions on the KMS used for the cluster encryption

terraform-aws-eks/main.tf

Lines 230 to 254 in 27f99f0

	resource "aws_iam_policy" "cluster_encryption" {
	count = local.create_iam_role && var.attach_cluster_encryption_policy && length(var.cluster_encryption_config) > 0 ? 1 : 0
	name_prefix = "${local.iam_role_name}-ClusterEncryption-"
	description = "Cluster encryption policy to allow cluster role to utilize CMK provided"
	policy = jsonencode({
	Version = "2012-10-17"
	Statement = [
	{
	Action = [
	"kms:Encrypt",
	"kms:Decrypt",
	"kms:ListGrants",
	"kms:DescribeKey",
	]
	Effect = "Allow"
	# TODO - does cluster_encryption_config need to be a list?!
	Resource = [for config in var.cluster_encryption_config : config.provider_key_arn]
	},
	]
	})
	tags = var.tags
	}

However, the name of this IAM Policy is always based on the role name
In my organization, there's an enforcement of different prefixes for both role and policy names.

Would it be possible to add cluster_encryption_policy_use_name_prefix and cluster_encryption_policy_name variables (in a similar fashion to how it works for the cluster role name) for this resource as well?

  name        = var.cluster_encryption_policy_use_name_prefix ? null : local.cluster_encryption_policy_name
  name_prefix = var.cluster_encryption_policy_use_name_prefix ? "${local.iam_role_name}-ClusterEncryption-" : null

[bryantbiggs]

its a role policy (i.e. - inline policy) and its pretty common/standard to name it the same as the role. However, you should be able to get around this by setting attach_cluster_encryption_policy = false and then attaching a policy that meets your organizations naming requirements (odd requirement but hey - to each their own)

[romogo17]

isn't the resource for inline policies aws_iam_role_policy instead of aws_iam_policy?

[bryantbiggs]

ah yes, you are correct - mobile for the win failure. let me see what we can do

[antonbabenko]

This issue has been resolved in version 18.9.0 🎉

[romogo17]

Awesome guys. Thanks!

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues. If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.