refactor: modularize Terraform IAM resources properly

- Add IAM module to main.tf composition
- Remove IAM role creation from EKS module
- EKS module now accepts cluster_role_arn and node_role_arn
- Add environment variable for multi-environment support
- Remove unused eks_role_name and node_role_name variables
- Follow single responsibility principle: IAM module owns all IAM resources
- Improve module reusability and separation of concerns

Author: tukue

infra/main.tf

@@ -19,26 +19,36 @@ provider "aws" {
   region = var.region
 }
 
+module "iam" {
+  source = "./modules/iam"
+
+  prefix = var.cluster_name
+  tags = {
+    Environment = var.environment
+    ManagedBy   = "Terraform"
+  }
+}
+
 module "vpc" {
   source = "./modules/vpc"
 
   vpc_cidr      = var.vpc_cidr
   subnet_1_cidr = var.subnet_1_cidr
   subnet_2_cidr = var.subnet_2_cidr
-  environment   = "dev"
+  environment   = var.environment
   cluster_name  = var.cluster_name
 }
 
 module "eks" {
   source = "./modules/eks"
 
-  vpc_id          = module.vpc.vpc_id
-  subnet_ids      = module.vpc.subnet_ids
-  cluster_name    = var.cluster_name
-  node_group_name = var.node_group_name
-  eks_role_name   = var.eks_role_name
-  node_role_name  = var.node_role_name
-  desired_size    = var.desired_size
-  min_size        = var.min_size
-  max_size        = var.max_size
+  vpc_id             = module.vpc.vpc_id
+  subnet_ids         = module.vpc.subnet_ids
+  cluster_name       = var.cluster_name
+  node_group_name    = var.node_group_name
+  cluster_role_arn   = module.iam.cluster_role_arn
+  node_role_arn      = module.iam.node_role_arn
+  desired_size       = var.desired_size
+  min_size           = var.min_size
+  max_size           = var.max_size
 }

infra/modules/eks/main.tf

@@ -8,142 +8,60 @@ terraform {
   }
 }
 
-# Create an IAM role for EKS
-resource "aws_iam_role" "eks_role" {
-  name = var.eks_role_name
-
-  assume_role_policy = jsonencode({
-    Version = "2012-10-17"
-    Statement = [
-      {
-        Effect = "Allow"
-        Principal = {
-          Service = "eks.amazonaws.com"
-        }
-        Action = "sts:AssumeRole"
-      }
-    ]
-  })
-}
-
-# Attach the required policies to the IAM role
-resource "aws_iam_role_policy_attachment" "eks_cluster_policy" {
-  role       = aws_iam_role.eks_role.name
-  policy_arn = "arn:aws:iam::aws:policy/AmazonEKSClusterPolicy"
-}
-
-resource "aws_iam_role_policy_attachment" "eks_service_policy" {
-  role       = aws_iam_role.eks_role.name
-  policy_arn = "arn:aws:iam::aws:policy/AmazonEKSServicePolicy"
-}
-
 # Create a security group for EKS
 resource "aws_security_group" "eks_sg" {
   name        = var.eks_sg_name
   description = "Security group for EKS cluster"
   vpc_id      = var.vpc_id
 
-  # Allow inbound HTTPS traffic for Kubernetes API server
   ingress {
     from_port   = 443
     to_port     = 443
     protocol    = "tcp"
     cidr_blocks = [var.allowed_cidr_block]
-  }
-
-  # Allow Kubelet API
-  ingress {
-    from_port = 10250
-    to_port   = 10250
-    protocol  = "tcp"
-    self      = true
-  }
-
-  # Allow NodePort Services
-  ingress {
-    from_port   = 30000
-    to_port     = 32767
-    protocol    = "tcp"
-    cidr_blocks = [var.allowed_cidr_block]
+    description = "Allow HTTPS traffic for Kubernetes API server"
   }
 
   egress {
     from_port   = 0
     to_port     = 0
     protocol    = "-1"
     cidr_blocks = ["0.0.0.0/0"]
+    description = "Allow all outbound traffic"
   }
 
   tags = {
     Name = var.eks_sg_name
   }
 }
 
-# Create an EKS cluster
-resource "aws_eks_cluster" "eks_cluster" {
+# Create the EKS cluster
+resource "aws_eks_cluster" "main" {
   name     = var.cluster_name
-  role_arn = aws_iam_role.eks_role.arn
+  role_arn = var.cluster_role_arn
 
   vpc_config {
     subnet_ids         = var.subnet_ids
     security_group_ids = [aws_security_group.eks_sg.id]
   }
 
-  depends_on = [
-    aws_iam_role_policy_attachment.eks_cluster_policy,
-    aws_iam_role_policy_attachment.eks_service_policy,
-  ]
-}
-
-# Create an IAM role for node group
-resource "aws_iam_role" "node_role" {
-  name = var.node_role_name
-
-  assume_role_policy = jsonencode({
-    Version = "2012-10-17"
-    Statement = [
-      {
-        Action = "sts:AssumeRole"
-        Effect = "Allow"
-        Principal = {
-          Service = "ec2.amazonaws.com"
-        }
-      },
-    ]
-  })
+  depends_on = [aws_security_group.eks_sg]
 }
 
-resource "aws_iam_role_policy_attachment" "node_policy" {
-  role       = aws_iam_role.node_role.name
-  policy_arn = "arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy"
-}
-
-resource "aws_iam_role_policy_attachment" "cni_policy" {
-  role       = aws_iam_role.node_role.name
-  policy_arn = "arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy"
-}
-
-resource "aws_iam_role_policy_attachment" "ecr_policy" {
-  role       = aws_iam_role.node_role.name
-  policy_arn = "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly"
-}
-
-# Create a node group
-resource "aws_eks_node_group" "node_group" {
-  cluster_name    = aws_eks_cluster.eks_cluster.name
+# Create the EKS node group
+resource "aws_eks_node_group" "main" {
+  cluster_name    = aws_eks_cluster.main.name
   node_group_name = var.node_group_name
-  node_role_arn   = aws_iam_role.node_role.arn
+  node_role_arn   = var.node_role_arn
   subnet_ids      = var.subnet_ids
 
   scaling_config {
     desired_size = var.desired_size
-    min_size     = var.min_size
     max_size     = var.max_size
+    min_size     = var.min_size
   }
 
-  depends_on = [
-    aws_iam_role_policy_attachment.node_policy,
-    aws_iam_role_policy_attachment.cni_policy,
-    aws_iam_role_policy_attachment.ecr_policy,
-  ]
+  instance_types = ["t3.medium"]
+
+  depends_on = [aws_eks_cluster.main]
 }

infra/modules/eks/variables.tf

@@ -1,9 +1,3 @@
-variable "allowed_cidr_block" {
-  description = "The CIDR block that is allowed to access the EKS cluster"
-  type        = string
-  default     = "10.0.0.0/16"
-}
-
 variable "vpc_id" {
   description = "The ID of the VPC where the EKS cluster will be created"
   type        = string
@@ -24,22 +18,14 @@ variable "node_group_name" {
   type        = string
 }
 
-variable "eks_role_name" {
-  description = "The name of the IAM role for the EKS cluster"
+variable "cluster_role_arn" {
+  description = "The ARN of the IAM role for the EKS cluster"
   type        = string
-  default     = "eks-cluster-role"
 }
 
-variable "node_role_name" {
-  description = "The name of the IAM role for the EKS node group"
+variable "node_role_arn" {
+  description = "The ARN of the IAM role for the EKS node group"
   type        = string
-  default     = "eks-node-role"
-}
-
-variable "eks_sg_name" {
-  description = "The name of the security group for the EKS cluster"
-  type        = string
-  default     = "eks-cluster-sg"
 }
 
 variable "desired_size" {
@@ -59,3 +45,15 @@ variable "max_size" {
   type        = number
   default     = 3
 }
+
+variable "allowed_cidr_block" {
+  description = "The CIDR block that is allowed to access the EKS cluster"
+  type        = string
+  default     = "10.0.0.0/16"
+}
+
+variable "eks_sg_name" {
+  description = "The name of the security group for the EKS cluster"
+  type        = string
+  default     = "eks-cluster-sg"
+}

infra/variables.tf

@@ -3,6 +3,12 @@ variable "region" {
   type        = string
 }
 
+variable "environment" {
+  description = "Environment name (dev, stage, prod)"
+  type        = string
+  default     = "dev"
+}
+
 variable "vpc_cidr" {
   description = "CIDR block for the VPC"
   type        = string
@@ -18,21 +24,11 @@ variable "subnet_2_cidr" {
   type        = string
 }
 
-variable "eks_role_name" {
-  description = "Name of the EKS IAM role"
-  type        = string
-}
-
 variable "cluster_name" {
   description = "Name of the EKS cluster"
   type        = string
 }
 
-variable "node_role_name" {
-  description = "Name of the node group IAM role"
-  type        = string
-}
-
 variable "node_group_name" {
   description = "Name of the node group"
   type        = string