Skip to content

Commit d88c48f

Browse files
neilkuanneilkuan
authored
feat: Update AWS LB Controller IAM policy and add AGA policy (#497)
1 parent 7fb6c18 commit d88c48f

File tree

4 files changed

+191
-4
lines changed

4 files changed

+191
-4
lines changed

‎README.md‎

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -134,9 +134,11 @@ module "eks" {
134134
| [aws_cloudwatch_log_group.fargate_fluentbit](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_log_group) | resource |
135135
| [aws_eks_addon.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/eks_addon) | resource |
136136
| [aws_iam_instance_profile.karpenter](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_instance_profile) | resource |
137+
| [aws_iam_policy.aws_load_balancer_controller_aga](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
137138
| [aws_iam_policy.fargate_fluentbit](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
138139
| [aws_iam_role.karpenter](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |
139140
| [aws_iam_role_policy_attachment.additional](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
141+
| [aws_iam_role_policy_attachment.aws_load_balancer_controller_aga](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
140142
| [aws_iam_role_policy_attachment.karpenter](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
141143
| [helm_release.this](https://registry.terraform.io/providers/hashicorp/helm/latest/docs/resources/release) | resource |
142144
| [kubernetes_config_map_v1.aws_logging](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/config_map_v1) | resource |
@@ -151,6 +153,7 @@ module "eks" {
151153
| [aws_iam_policy_document.aws_fsx_csi_driver](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
152154
| [aws_iam_policy_document.aws_gateway_api_controller](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
153155
| [aws_iam_policy_document.aws_load_balancer_controller](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
156+
| [aws_iam_policy_document.aws_load_balancer_controller_aga](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
154157
| [aws_iam_policy_document.aws_node_termination_handler](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
155158
| [aws_iam_policy_document.aws_privateca_issuer](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
156159
| [aws_iam_policy_document.cert_manager](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
@@ -187,7 +190,7 @@ module "eks" {
187190
| <a name="input_bottlerocket_shadow"></a> [bottlerocket\_shadow](#input\_bottlerocket\_shadow) | Bottlerocket Update Operator CRDs configuration values | `any` | `{}` | no |
188191
| <a name="input_bottlerocket_update_operator"></a> [bottlerocket\_update\_operator](#input\_bottlerocket\_update\_operator) | Bottlerocket Update Operator add-on configuration values | `any` | `{}` | no |
189192
| <a name="input_cert_manager"></a> [cert\_manager](#input\_cert\_manager) | cert-manager add-on configuration values | `any` | `{}` | no |
190-
| <a name="input_cert_manager_route53_hosted_zone_arns"></a> [cert\_manager\_route53\_hosted\_zone\_arns](#input\_cert\_manager\_route53\_hosted\_zone\_arns) | List of Route53 Hosted Zone ARNs that are used by cert-manager to create DNS records | `list(string)` | <pre>[<br/> "arn:aws:route53:::hostedzone/*"<br/>]</pre> | no |
193+
| <a name="input_cert_manager_route53_hosted_zone_arns"></a> [cert\_manager\_route53\_hosted\_zone\_arns](#input\_cert\_manager\_route53\_hosted\_zone\_arns) | List of Route53 Hosted Zone ARNs that are used by cert-manager to create DNS records | `list(string)` | <pre>[<br> "arn:aws:route53:::hostedzone/*"<br>]</pre> | no |
191194
| <a name="input_cluster_autoscaler"></a> [cluster\_autoscaler](#input\_cluster\_autoscaler) | Cluster Autoscaler add-on configuration values | `any` | `{}` | no |
192195
| <a name="input_cluster_endpoint"></a> [cluster\_endpoint](#input\_cluster\_endpoint) | Endpoint for your Kubernetes API server | `string` | n/a | yes |
193196
| <a name="input_cluster_name"></a> [cluster\_name](#input\_cluster\_name) | Name of the EKS cluster | `string` | n/a | yes |
@@ -208,6 +211,7 @@ module "eks" {
208211
| <a name="input_enable_aws_fsx_csi_driver"></a> [enable\_aws\_fsx\_csi\_driver](#input\_enable\_aws\_fsx\_csi\_driver) | Enable AWS FSX CSI Driver add-on | `bool` | `false` | no |
209212
| <a name="input_enable_aws_gateway_api_controller"></a> [enable\_aws\_gateway\_api\_controller](#input\_enable\_aws\_gateway\_api\_controller) | Enable AWS Gateway API Controller add-on | `bool` | `false` | no |
210213
| <a name="input_enable_aws_load_balancer_controller"></a> [enable\_aws\_load\_balancer\_controller](#input\_enable\_aws\_load\_balancer\_controller) | Enable AWS Load Balancer Controller add-on | `bool` | `false` | no |
214+
| <a name="input_enable_aws_load_balancer_controller_aga"></a> [enable\_aws\_load\_balancer\_controller\_aga](#input\_enable\_aws\_load\_balancer\_controller\_aga) | Enable AWS Load Balancer Controller Global Accelerator (AGA) IAM policy | `bool` | `false` | no |
211215
| <a name="input_enable_aws_node_termination_handler"></a> [enable\_aws\_node\_termination\_handler](#input\_enable\_aws\_node\_termination\_handler) | Enable AWS Node Termination Handler add-on | `bool` | `false` | no |
212216
| <a name="input_enable_aws_privateca_issuer"></a> [enable\_aws\_privateca\_issuer](#input\_enable\_aws\_privateca\_issuer) | Enable AWS PCA Issuer | `bool` | `false` | no |
213217
| <a name="input_enable_bottlerocket_update_operator"></a> [enable\_bottlerocket\_update\_operator](#input\_enable\_bottlerocket\_update\_operator) | Enable Bottlerocket Update Operator add-on | `bool` | `false` | no |
@@ -230,9 +234,9 @@ module "eks" {
230234
| <a name="input_external_dns"></a> [external\_dns](#input\_external\_dns) | external-dns add-on configuration values | `any` | `{}` | no |
231235
| <a name="input_external_dns_route53_zone_arns"></a> [external\_dns\_route53\_zone\_arns](#input\_external\_dns\_route53\_zone\_arns) | List of Route53 zones ARNs which external-dns will have access to create/manage records (if using Route53) | `list(string)` | `[]` | no |
232236
| <a name="input_external_secrets"></a> [external\_secrets](#input\_external\_secrets) | External Secrets add-on configuration values | `any` | `{}` | no |
233-
| <a name="input_external_secrets_kms_key_arns"></a> [external\_secrets\_kms\_key\_arns](#input\_external\_secrets\_kms\_key\_arns) | List of KMS Key ARNs that are used by Secrets Manager that contain secrets to mount using External Secrets | `list(string)` | <pre>[<br/> "arn:aws:kms:*:*:key/*"<br/>]</pre> | no |
234-
| <a name="input_external_secrets_secrets_manager_arns"></a> [external\_secrets\_secrets\_manager\_arns](#input\_external\_secrets\_secrets\_manager\_arns) | List of Secrets Manager ARNs that contain secrets to mount using External Secrets | `list(string)` | <pre>[<br/> "arn:aws:secretsmanager:*:*:secret:*"<br/>]</pre> | no |
235-
| <a name="input_external_secrets_ssm_parameter_arns"></a> [external\_secrets\_ssm\_parameter\_arns](#input\_external\_secrets\_ssm\_parameter\_arns) | List of Systems Manager Parameter ARNs that contain secrets to mount using External Secrets | `list(string)` | <pre>[<br/> "arn:aws:ssm:*:*:parameter/*"<br/>]</pre> | no |
237+
| <a name="input_external_secrets_kms_key_arns"></a> [external\_secrets\_kms\_key\_arns](#input\_external\_secrets\_kms\_key\_arns) | List of KMS Key ARNs that are used by Secrets Manager that contain secrets to mount using External Secrets | `list(string)` | <pre>[<br> "arn:aws:kms:*:*:key/*"<br>]</pre> | no |
238+
| <a name="input_external_secrets_secrets_manager_arns"></a> [external\_secrets\_secrets\_manager\_arns](#input\_external\_secrets\_secrets\_manager\_arns) | List of Secrets Manager ARNs that contain secrets to mount using External Secrets | `list(string)` | <pre>[<br> "arn:aws:secretsmanager:*:*:secret:*"<br>]</pre> | no |
239+
| <a name="input_external_secrets_ssm_parameter_arns"></a> [external\_secrets\_ssm\_parameter\_arns](#input\_external\_secrets\_ssm\_parameter\_arns) | List of Systems Manager Parameter ARNs that contain secrets to mount using External Secrets | `list(string)` | <pre>[<br> "arn:aws:ssm:*:*:parameter/*"<br>]</pre> | no |
236240
| <a name="input_fargate_fluentbit"></a> [fargate\_fluentbit](#input\_fargate\_fluentbit) | Fargate fluentbit add-on config | `any` | `{}` | no |
237241
| <a name="input_fargate_fluentbit_cw_log_group"></a> [fargate\_fluentbit\_cw\_log\_group](#input\_fargate\_fluentbit\_cw\_log\_group) | AWS Fargate Fluentbit CloudWatch Log Group configurations | `any` | `{}` | no |
238242
| <a name="input_gatekeeper"></a> [gatekeeper](#input\_gatekeeper) | Gatekeeper add-on configuration | `any` | `{}` | no |
@@ -267,6 +271,7 @@ module "eks" {
267271
| <a name="output_aws_fsx_csi_driver"></a> [aws\_fsx\_csi\_driver](#output\_aws\_fsx\_csi\_driver) | Map of attributes of the Helm release and IRSA created |
268272
| <a name="output_aws_gateway_api_controller"></a> [aws\_gateway\_api\_controller](#output\_aws\_gateway\_api\_controller) | Map of attributes of the Helm release and IRSA created |
269273
| <a name="output_aws_load_balancer_controller"></a> [aws\_load\_balancer\_controller](#output\_aws\_load\_balancer\_controller) | Map of attributes of the Helm release and IRSA created |
274+
| <a name="output_aws_load_balancer_controller_aga"></a> [aws\_load\_balancer\_controller\_aga](#output\_aws\_load\_balancer\_controller\_aga) | Map of attributes of the Global Accelerator IAM policy for AWS Load Balancer Controller |
270275
| <a name="output_aws_node_termination_handler"></a> [aws\_node\_termination\_handler](#output\_aws\_node\_termination\_handler) | Map of attributes of the Helm release and IRSA created |
271276
| <a name="output_aws_privateca_issuer"></a> [aws\_privateca\_issuer](#output\_aws\_privateca\_issuer) | Map of attributes of the Helm release and IRSA created |
272277
| <a name="output_bottlerocket_update_operator"></a> [bottlerocket\_update\_operator](#output\_bottlerocket\_update\_operator) | Map of attributes of the Helm release and IRSA created |

‎main.tf‎

Lines changed: 169 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1204,6 +1204,7 @@ data "aws_iam_policy_document" "aws_load_balancer_controller" {
12041204
"ec2:DescribeCoipPools",
12051205
"ec2:GetSecurityGroupsForVpc",
12061206
"ec2:DescribeIpamPools",
1207+
"ec2:DescribeRouteTables",
12071208
"elasticloadbalancing:DescribeLoadBalancers",
12081209
"elasticloadbalancing:DescribeLoadBalancerAttributes",
12091210
"elasticloadbalancing:DescribeListeners",
@@ -1525,6 +1526,174 @@ module "aws_load_balancer_controller" {
15251526
tags = var.tags
15261527
}
15271528

1529+
################################################################################
1530+
# AWS Load Balancer Controller - Global Accelerator (AGA) Policy
1531+
################################################################################
1532+
1533+
# https://github.com/kubernetes-sigs/aws-load-balancer-controller/blob/main/docs/install/aga_controller_iam_policy.json
1534+
data "aws_iam_policy_document" "aws_load_balancer_controller_aga" {
1535+
count = var.enable_aws_load_balancer_controller_aga ? 1 : 0
1536+
1537+
statement {
1538+
actions = ["iam:CreateServiceLinkedRole"]
1539+
resources = ["*"]
1540+
1541+
condition {
1542+
test = "StringEquals"
1543+
variable = "iam:AWSServiceName"
1544+
values = ["globalaccelerator.amazonaws.com"]
1545+
}
1546+
}
1547+
1548+
statement {
1549+
actions = [
1550+
"globalaccelerator:ListAccelerators",
1551+
"globalaccelerator:ListEndpointGroups",
1552+
"globalaccelerator:ListListeners",
1553+
"globalaccelerator:ListTagsForResource",
1554+
"ec2:DescribeRegions",
1555+
"tag:GetResources",
1556+
]
1557+
resources = ["*"]
1558+
}
1559+
1560+
statement {
1561+
actions = [
1562+
"globalaccelerator:DescribeAccelerator",
1563+
"globalaccelerator:DescribeEndpointGroup",
1564+
"globalaccelerator:DescribeListener",
1565+
]
1566+
resources = [
1567+
"arn:${local.partition}:globalaccelerator::*:accelerator/*",
1568+
"arn:${local.partition}:globalaccelerator::*:accelerator/*/listener/*",
1569+
"arn:${local.partition}:globalaccelerator::*:accelerator/*/listener/*/endpoint-group/*",
1570+
]
1571+
1572+
condition {
1573+
test = "Null"
1574+
variable = "aws:ResourceTag/elbv2.k8s.aws/cluster"
1575+
values = ["false"]
1576+
}
1577+
1578+
condition {
1579+
test = "StringEquals"
1580+
variable = "aws:ResourceTag/aga.k8s.aws/resource"
1581+
values = ["GlobalAccelerator"]
1582+
}
1583+
}
1584+
1585+
statement {
1586+
actions = ["globalaccelerator:CreateAccelerator"]
1587+
resources = ["*"]
1588+
1589+
condition {
1590+
test = "Null"
1591+
variable = "aws:RequestTag/elbv2.k8s.aws/cluster"
1592+
values = ["false"]
1593+
}
1594+
1595+
condition {
1596+
test = "StringEquals"
1597+
variable = "aws:RequestTag/aga.k8s.aws/resource"
1598+
values = ["GlobalAccelerator"]
1599+
}
1600+
}
1601+
1602+
statement {
1603+
actions = [
1604+
"globalaccelerator:UpdateAccelerator",
1605+
"globalaccelerator:DeleteAccelerator",
1606+
"globalaccelerator:CreateListener",
1607+
"globalaccelerator:UpdateListener",
1608+
"globalaccelerator:DeleteListener",
1609+
"globalaccelerator:CreateEndpointGroup",
1610+
"globalaccelerator:UpdateEndpointGroup",
1611+
"globalaccelerator:DeleteEndpointGroup",
1612+
"globalaccelerator:AddEndpoints",
1613+
"globalaccelerator:RemoveEndpoints",
1614+
]
1615+
resources = [
1616+
"arn:${local.partition}:globalaccelerator::*:accelerator/*",
1617+
"arn:${local.partition}:globalaccelerator::*:accelerator/*/listener/*",
1618+
"arn:${local.partition}:globalaccelerator::*:accelerator/*/listener/*/endpoint-group/*",
1619+
]
1620+
1621+
condition {
1622+
test = "Null"
1623+
variable = "aws:ResourceTag/elbv2.k8s.aws/cluster"
1624+
values = ["false"]
1625+
}
1626+
1627+
condition {
1628+
test = "StringEquals"
1629+
variable = "aws:ResourceTag/aga.k8s.aws/resource"
1630+
values = ["GlobalAccelerator"]
1631+
}
1632+
}
1633+
1634+
statement {
1635+
actions = [
1636+
"globalaccelerator:TagResource",
1637+
"globalaccelerator:UntagResource",
1638+
]
1639+
resources = ["arn:${local.partition}:globalaccelerator::*:accelerator/*"]
1640+
1641+
condition {
1642+
test = "Null"
1643+
variable = "aws:RequestTag/elbv2.k8s.aws/cluster"
1644+
values = ["true"]
1645+
}
1646+
1647+
condition {
1648+
test = "Null"
1649+
variable = "aws:ResourceTag/elbv2.k8s.aws/cluster"
1650+
values = ["false"]
1651+
}
1652+
1653+
condition {
1654+
test = "StringEquals"
1655+
variable = "aws:ResourceTag/aga.k8s.aws/resource"
1656+
values = ["GlobalAccelerator"]
1657+
}
1658+
}
1659+
1660+
statement {
1661+
actions = ["globalaccelerator:TagResource"]
1662+
resources = ["arn:${local.partition}:globalaccelerator::*:accelerator/*"]
1663+
1664+
condition {
1665+
test = "Null"
1666+
variable = "aws:RequestTag/elbv2.k8s.aws/cluster"
1667+
values = ["false"]
1668+
}
1669+
1670+
condition {
1671+
test = "StringEquals"
1672+
variable = "aws:RequestTag/aga.k8s.aws/resource"
1673+
values = ["GlobalAccelerator"]
1674+
}
1675+
}
1676+
}
1677+
1678+
resource "aws_iam_policy" "aws_load_balancer_controller_aga" {
1679+
count = var.enable_aws_load_balancer_controller_aga ? 1 : 0
1680+
1681+
name = try(var.aws_load_balancer_controller.aga_policy_name_use_prefix, true) ? null : try(var.aws_load_balancer_controller.aga_policy_name, "aws-load-balancer-controller-aga")
1682+
name_prefix = try(var.aws_load_balancer_controller.aga_policy_name_use_prefix, true) ? "${try(var.aws_load_balancer_controller.aga_policy_name, "aws-load-balancer-controller-aga")}-" : null
1683+
path = try(var.aws_load_balancer_controller.policy_path, null)
1684+
description = "IAM Policy for AWS Load Balancer Controller - Global Accelerator"
1685+
policy = data.aws_iam_policy_document.aws_load_balancer_controller_aga[0].json
1686+
1687+
tags = var.tags
1688+
}
1689+
1690+
resource "aws_iam_role_policy_attachment" "aws_load_balancer_controller_aga" {
1691+
count = var.enable_aws_load_balancer_controller_aga ? 1 : 0
1692+
1693+
policy_arn = aws_iam_policy.aws_load_balancer_controller_aga[0].arn
1694+
role = module.aws_load_balancer_controller.iam_role_name
1695+
}
1696+
15281697
################################################################################
15291698
# AWS Node Termination Handler
15301699
################################################################################

‎outputs.tf‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,13 @@ output "aws_load_balancer_controller" {
4343
value = module.aws_load_balancer_controller
4444
}
4545

46+
output "aws_load_balancer_controller_aga" {
47+
description = "Map of attributes of the Global Accelerator IAM policy for AWS Load Balancer Controller"
48+
value = {
49+
iam_policy_arn = try(aws_iam_policy.aws_load_balancer_controller_aga[0].arn, null)
50+
}
51+
}
52+
4653
output "aws_node_termination_handler" {
4754
description = "Map of attributes of the Helm release and IRSA created"
4855
value = merge(

‎variables.tf‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -202,6 +202,12 @@ variable "aws_load_balancer_controller" {
202202
default = {}
203203
}
204204

205+
variable "enable_aws_load_balancer_controller_aga" {
206+
description = "Enable AWS Load Balancer Controller Global Accelerator (AGA) IAM policy"
207+
type = bool
208+
default = false
209+
}
210+
205211
################################################################################
206212
# AWS Node Termination Handler
207213
################################################################################

0 commit comments

Comments
 (0)