Merge pull request #7366 from borg-land/capa-aws-sso

Configure AWS SSO for aws-capa-ami account

Author: k8s-ci-robot

infra/aws/terraform/management-account/organization-accounts-capa-playground.tf

@@ -21,4 +21,9 @@ module "k8s-infra-sandbox-capa" {
   email                      = "[email protected]"
   iam_user_access_to_billing = "ALLOW"
   parent_id                  = aws_organizations_organizational_unit.production.id
+  permissions_map = {
+    "aws-capa-maintainers" = [
+      "AdministratorAccess",
+    ]
+  }
 }

infra/aws/terraform/management-account/organization-accounts-workloads-prod.tf

@@ -59,3 +59,27 @@ module "obs-k8s-io" {
     "service"     = "obs"
   }
 }
+
+
+module "capa-ami" {
+  source = "../modules/org-account"
+
+  account_name = "cncf-k8s-infra-aws-capa-ami"
+  email        = "[email protected]"
+  parent_id    = aws_organizations_organizational_unit.production.id
+  tags = {
+    "production"  = "true",
+    "environment" = "prod",
+    "group"       = "sig-cluster-lifecycle",
+  }
+  permissions_map = {
+    "aws-capa-maintainers" = [
+      "AdministratorAccess",
+    ]
+  }
+  aws_account_regions = [
+    "ap-east-1",
+    "ap-southeast-3",
+    "eu-south-2",
+  ]
+}

infra/aws/terraform/management-account/provider.tf

@@ -30,7 +30,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "~> 4.67.0"
+      version = "~> 5.67.0"
     }
   }
 }

infra/aws/terraform/modules/org-account/main.tf

@@ -40,3 +40,10 @@ resource "aws_organizations_account" "this" {
     ]
   }
 }
+
+resource "aws_account_region" "this" {
+  for_each    = toset(var.aws_account_regions)
+  region_name = each.key
+  account_id  = aws_organizations_account.this.id
+  enabled     = true
+}

infra/aws/terraform/modules/org-account/variables.tf

@@ -58,3 +58,10 @@ variable "permissions_map" {
   type        = map(any)
   description = "A map of permissions"
 }
+
+variable "aws_account_regions" {
+  default     = []
+  type        = list(string)
+  description = "List of opt-in AWS regions to enable for this account"
+}
+