81 lines
1.9 KiB
HCL
81 lines
1.9 KiB
HCL
# IAM role for the EC2 node
|
|
# Grants the node (and all pods on it) access to AWS services via instance metadata.
|
|
# Add policies here as new services need AWS access.
|
|
|
|
resource "aws_iam_role" "node" {
|
|
name = "${var.cluster_name}-node"
|
|
|
|
assume_role_policy = jsonencode({
|
|
Version = "2012-10-17"
|
|
Statement = [{
|
|
Effect = "Allow"
|
|
Principal = { Service = "ec2.amazonaws.com" }
|
|
Action = "sts:AssumeRole"
|
|
}]
|
|
})
|
|
}
|
|
|
|
resource "aws_iam_instance_profile" "node" {
|
|
name = "${var.cluster_name}-node"
|
|
role = aws_iam_role.node.name
|
|
}
|
|
|
|
# S3 access for fluent-bit log shipping
|
|
resource "aws_iam_role_policy" "node_s3_logs" {
|
|
name = "s3-logs-write"
|
|
role = aws_iam_role.node.id
|
|
|
|
policy = jsonencode({
|
|
Version = "2012-10-17"
|
|
Statement = [
|
|
{
|
|
Effect = "Allow"
|
|
Action = ["s3:PutObject", "s3:GetObject", "s3:ListBucket"]
|
|
Resource = [
|
|
aws_s3_bucket.logs.arn,
|
|
"${aws_s3_bucket.logs.arn}/*"
|
|
]
|
|
}
|
|
]
|
|
})
|
|
}
|
|
|
|
# Secrets Manager access for External Secrets Operator
|
|
resource "aws_iam_role_policy" "node_secrets_manager" {
|
|
name = "secrets-manager-read"
|
|
role = aws_iam_role.node.id
|
|
|
|
policy = jsonencode({
|
|
Version = "2012-10-17"
|
|
Statement = [
|
|
{
|
|
Effect = "Allow"
|
|
Action = ["secretsmanager:GetSecretValue", "secretsmanager:DescribeSecret"]
|
|
Resource = aws_secretsmanager_secret.dumpnet.arn
|
|
}
|
|
]
|
|
})
|
|
}
|
|
|
|
|
|
# ECR pull access for node (to pull custom images like mcp-auth-proxy)
|
|
resource "aws_iam_role_policy" "node_ecr" {
|
|
name = "ecr-pull"
|
|
role = aws_iam_role.node.id
|
|
|
|
policy = jsonencode({
|
|
Version = "2012-10-17"
|
|
Statement = [
|
|
{
|
|
Effect = "Allow"
|
|
Action = [
|
|
"ecr:GetDownloadUrlForLayer",
|
|
"ecr:BatchGetImage",
|
|
"ecr:BatchCheckLayerAvailability",
|
|
"ecr:GetAuthorizationToken"
|
|
]
|
|
Resource = "*"
|
|
}
|
|
]
|
|
})
|
|
}
|