Merge pull request #139 from resource-watch/add_oidc_role_to_eks

Adds access entry for GHA OIDC role. (Self-approving for a small change)

Author: tanderegg

terraform/main.tf

@@ -56,6 +56,7 @@ module "eks" {
   ebs_csi_addon_version = var.ebs_csi_addon_version
   kube_proxy_addon_version = var.kube_proxy_addon_version
   admin_role_arns       = data.aws_iam_roles.admin_arn.arns
+  gha_role_arn          = var.gha_role_arn
   subnet_ids = [
     module.vpc.private_subnets[0].id,
     module.vpc.private_subnets[1].id,

terraform/modules/eks/main.tf

@@ -286,3 +286,23 @@ resource "aws_eks_access_policy_association" "admin_policy" {
     aws_eks_access_entry.admin_role
   ]
 }
+
+resource "aws_eks_access_entry" "gha_role" {
+  cluster_name  = aws_eks_cluster.eks_cluster.name
+  principal_arn = var.gha_role_arn
+  type          = "STANDARD"
+}
+
+resource "aws_eks_access_policy_association" "gha_policy" {
+  cluster_name    = aws_eks_cluster.eks_cluster.name
+  policy_arn      = "arn:aws:eks::aws:cluster-access-policy/AmazonEKSClusterAdminPolicy"
+  principal_arn   = var.gha_role_arn
+
+  access_scope {
+    type = "cluster"
+  }
+
+  depends_on = [
+    aws_eks_access_entry.gha_role
+  ]
+}

terraform/modules/eks/variable.tf

@@ -44,3 +44,8 @@ variable "admin_role_arns" {
   type        = set(string)
   description = "ARN of the Role used for admin cluster access."
 }
+
+variable "gha_role_arn" {
+  type        = string
+  description = "ARN of the Role used for Github Actions."
+}

terraform/variables.tf

@@ -283,3 +283,8 @@ variable "email_recipients" {
   description = "List of email addresses to contact in case an alert fails"
   default     = []
 }
+
+variable "gha_role_arn" {
+  type        = string
+  description = "ARN of the Role used for Github Actions."
+}

terraform/vars/terraform-dev.tfvars

@@ -26,3 +26,4 @@ gateway_node_group_desired_size = 0
 hibernate                       = false
 aq_bucket_cors_allowed_origin   = "*"
 deploy_sparkpost_templates      = false
+gha_role_arn                    = "arn:aws:iam::842534099497:role/wri-api-dev-githubactions-role"