dumpnet-argo/terraform/iam.tf

81 lines
1.9 KiB
HCL

# IAM role for the EC2 node
# Grants the node (and all pods on it) access to AWS services via instance metadata.
# Add policies here as new services need AWS access.
resource "aws_iam_role" "node" {
name = "${var.cluster_name}-node"
assume_role_policy = jsonencode({
Version = "2012-10-17"
Statement = [{
Effect = "Allow"
Principal = { Service = "ec2.amazonaws.com" }
Action = "sts:AssumeRole"
}]
})
}
resource "aws_iam_instance_profile" "node" {
name = "${var.cluster_name}-node"
role = aws_iam_role.node.name
}
# S3 access for fluent-bit log shipping
resource "aws_iam_role_policy" "node_s3_logs" {
name = "s3-logs-write"
role = aws_iam_role.node.id
policy = jsonencode({
Version = "2012-10-17"
Statement = [
{
Effect = "Allow"
Action = ["s3:PutObject", "s3:GetObject", "s3:ListBucket"]
Resource = [
aws_s3_bucket.logs.arn,
"${aws_s3_bucket.logs.arn}/*"
]
}
]
})
}
# Secrets Manager access for External Secrets Operator
resource "aws_iam_role_policy" "node_secrets_manager" {
name = "secrets-manager-read"
role = aws_iam_role.node.id
policy = jsonencode({
Version = "2012-10-17"
Statement = [
{
Effect = "Allow"
Action = ["secretsmanager:GetSecretValue", "secretsmanager:DescribeSecret"]
Resource = aws_secretsmanager_secret.dumpnet.arn
}
]
})
}
# ECR pull access for node (to pull custom images like mcp-auth-proxy)
resource "aws_iam_role_policy" "node_ecr" {
name = "ecr-pull"
role = aws_iam_role.node.id
policy = jsonencode({
Version = "2012-10-17"
Statement = [
{
Effect = "Allow"
Action = [
"ecr:GetDownloadUrlForLayer",
"ecr:BatchGetImage",
"ecr:BatchCheckLayerAvailability",
"ecr:GetAuthorizationToken"
]
Resource = "*"
}
]
})
}