diff --git a/terraform-modules/aws/kubernetes/pod_assumable_role/README.md b/terraform-modules/aws/kubernetes/pod_assumable_role/README.md new file mode 100644 index 000000000..79b142273 --- /dev/null +++ b/terraform-modules/aws/kubernetes/pod_assumable_role/README.md @@ -0,0 +1,50 @@ +# pod_assumable_role + +This module helps you to create an AWS IAM assumable role by a pod. + +https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html + +This will allow you to give a pod in an EKS cluster a role to assume to gain access to AWS resources instead +of having to pass an AWS key pair to the pod. This is the preferred method since AWS key +pairs are long lived static keys while the assumable roles generates short lived keys that +are constantly rotated. + +## Requirements + +No requirements. + +## Providers + +| Name | Version | +|------|---------| +| [aws](#provider\_aws) | n/a | + +## Modules + +| Name | Source | Version | +|------|--------|---------| +| [iam\_assumable\_role](#module\_iam\_assumable\_role) | terraform-aws-modules/iam/aws//modules/iam-assumable-role-with-oidc | 4.20.3 | + +## Resources + +| Name | Type | +|------|------| +| [aws_iam_policy.iam_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource | + +## Inputs + +| Name | Description | Type | Default | Required | +|------|-------------|------|---------|:--------:| +| [eks\_cluster\_oidc\_issuer\_url](#input\_eks\_cluster\_oidc\_issuer\_url) | EKS cluster oidc issuer url | `string` | `""` | no | +| [iam\_policy\_description](#input\_iam\_policy\_description) | The description to place onto the IAM policy | `string` | `"The policy created by the pod_assumable_role Terraform module"` | no | +| [iam\_policy\_json](#input\_iam\_policy\_json) | The IAM policy json | `string` | `"{}"` | no | +| [k8s\_namespace](#input\_k8s\_namespace) | The namespace that this service account will be used in | `string` | `"my_namespace"` | no | +| [name](#input\_name) | The name to use for the various resources: IAM role, policy, etc | `string` | n/a | yes | +| [tags](#input\_tags) | Set of tags to place on the resources | `map(any)` | `{}` | no | + +## Outputs + +| Name | Description | +|------|-------------| +| [arn](#output\_arn) | n/a | +| [name](#output\_name) | n/a | diff --git a/terraform-modules/aws/kubernetes/pod_assumable_role/main.tf b/terraform-modules/aws/kubernetes/pod_assumable_role/main.tf new file mode 100644 index 000000000..cb3d2a121 --- /dev/null +++ b/terraform-modules/aws/kubernetes/pod_assumable_role/main.tf @@ -0,0 +1,17 @@ +module "iam_assumable_role" { + source = "terraform-aws-modules/iam/aws//modules/iam-assumable-role-with-oidc" + version = "4.20.3" + create_role = true + role_name = var.name + provider_url = replace(var.eks_cluster_oidc_issuer_url, "https://", "") + role_policy_arns = [aws_iam_policy.iam_policy.arn] + oidc_fully_qualified_subjects = ["system:serviceaccount:${var.k8s_namespace}:${var.name}"] + tags = var.tags +} + +resource "aws_iam_policy" "iam_policy" { + name_prefix = var.name + description = var.iam_policy_description + policy = var.iam_policy_json + tags = var.tags +} diff --git a/terraform-modules/aws/kubernetes/pod_assumable_role/outputs.tf b/terraform-modules/aws/kubernetes/pod_assumable_role/outputs.tf new file mode 100644 index 000000000..e6d7f2e66 --- /dev/null +++ b/terraform-modules/aws/kubernetes/pod_assumable_role/outputs.tf @@ -0,0 +1,7 @@ +output "arn" { + value = module.iam_assumable_role.iam_role_arn +} + +output "name" { + value = module.iam_assumable_role.iam_role_name +} \ No newline at end of file diff --git a/terraform-modules/aws/kubernetes/pod_assumable_role/variables.tf b/terraform-modules/aws/kubernetes/pod_assumable_role/variables.tf new file mode 100644 index 000000000..d78924cce --- /dev/null +++ b/terraform-modules/aws/kubernetes/pod_assumable_role/variables.tf @@ -0,0 +1,34 @@ +variable "name" { + type = string + description = "The name to use for the various resources: IAM role, policy, etc" +} + +variable "eks_cluster_oidc_issuer_url" { + type = string + default = "" + description = "EKS cluster oidc issuer url" +} + +variable "k8s_namespace" { + type = string + description = "The namespace that this service account will be used in" + default = "my_namespace" +} + +variable "iam_policy_description" { + type = string + description = "The description to place onto the IAM policy" + default = "The policy created by the pod_assumable_role Terraform module" +} + +variable "tags" { + type = map(any) + description = "Set of tags to place on the resources" + default = {} +} + +variable "iam_policy_json" { + type = string + description = "The IAM policy json" + default = "{}" +} diff --git a/terraform-modules/aws/ses/email_identity/main.tf b/terraform-modules/aws/ses/email_identity/main.tf new file mode 100644 index 000000000..aa4365700 --- /dev/null +++ b/terraform-modules/aws/ses/email_identity/main.tf @@ -0,0 +1,3 @@ +resource "aws_ses_email_identity" "this" { + email = var.email +} diff --git a/terraform-modules/aws/ses/email_identity/variables.tf b/terraform-modules/aws/ses/email_identity/variables.tf new file mode 100644 index 000000000..cbb1a1bff --- /dev/null +++ b/terraform-modules/aws/ses/email_identity/variables.tf @@ -0,0 +1,3 @@ +variable "email" { + description = "The email to add" +} \ No newline at end of file