Setup s3 access at ec2 level

terraform/iam.tf

@@ -0,0 +1,41 @@
+# IAM role for the EC2 node
+# Grants the node (and all pods on it) access to AWS services via instance metadata.
+# Add policies here as new services need AWS access.
+
+resource "aws_iam_role" "node" {
+  name = "${var.cluster_name}-node"
+
+  assume_role_policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [{
+      Effect    = "Allow"
+      Principal = { Service = "ec2.amazonaws.com" }
+      Action    = "sts:AssumeRole"
+    }]
+  })
+}
+
+resource "aws_iam_instance_profile" "node" {
+  name = "${var.cluster_name}-node"
+  role = aws_iam_role.node.name
+}
+
+# S3 access for fluent-bit log shipping
+resource "aws_iam_role_policy" "node_s3_logs" {
+  name = "s3-logs-write"
+  role = aws_iam_role.node.id
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Effect   = "Allow"
+        Action   = ["s3:PutObject", "s3:GetObject", "s3:ListBucket"]
+        Resource = [
+          aws_s3_bucket.logs.arn,
+          "${aws_s3_bucket.logs.arn}/*"
+        ]
+      }
+    ]
+  })
+}