feat: add permissions boundary support for all IAM roles (#95)

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: Joachim Hill-Grannec <joachim.hill@gmail.com>

Author: 3 people

main.tf

@@ -7,10 +7,12 @@ terraform {
     }
   }
 }
-data "aws_partition" "current" {} # Used for GovCloud/China partition-aware ARN construction
+data "aws_partition" "current" {}
+data "aws_caller_identity" "current" {}
 
 locals {
-  is_arm = can(regex("[a-zA-Z]+\\d+g[a-z]*\\..+", var.stack_pelotech_nat_instance_type))
+  permissions_boundary_arn = var.permissions_boundary != "" ? "arn:${data.aws_partition.current.partition}:iam::${data.aws_caller_identity.current.account_id}:policy/${var.permissions_boundary}" : null
+  is_arm                   = can(regex("[a-zA-Z]+\\d+g[a-z]*\\..+", var.stack_pelotech_nat_instance_type))
   admin_access_entries = {
     for index, item in var.stack_admin_arns : "admin_${index}" => {
       principal_arn = item
@@ -152,15 +154,16 @@ resource "aws_vpc_endpoint" "eks_vpc_endpoints" {
 }
 
 module "eks" {
-  source                     = "terraform-aws-modules/eks/aws"
-  version                    = "21.15.1"
-  name                       = var.stack_name
-  kubernetes_version         = var.eks_cluster_version
-  create                     = var.stack_create
-  create_node_security_group = var.create_node_security_group
-  endpoint_private_access    = true
-  endpoint_public_access     = var.cluster_endpoint_public_access
-  enabled_log_types          = var.cluster_enabled_log_types
+  source                        = "terraform-aws-modules/eks/aws"
+  version                       = "21.15.1"
+  name                          = var.stack_name
+  kubernetes_version            = var.eks_cluster_version
+  create                        = var.stack_create
+  create_node_security_group    = var.create_node_security_group
+  iam_role_permissions_boundary = local.permissions_boundary_arn
+  endpoint_private_access       = true
+  endpoint_public_access        = var.cluster_endpoint_public_access
+  enabled_log_types             = var.cluster_enabled_log_types
 
   vpc_id         = var.stack_existing_vpc_config != null ? var.stack_existing_vpc_config.vpc_id : module.vpc.vpc_id
   subnet_ids     = var.stack_existing_vpc_config != null ? var.stack_existing_vpc_config.subnet_ids : module.vpc.private_subnets
@@ -175,6 +178,7 @@ module "eks" {
   eks_managed_node_groups = var.stack_enable_default_eks_managed_node_group ? {
     "initial-${var.stack_name}" = {
       iam_role_use_name_prefix       = false
+      iam_role_permissions_boundary  = local.permissions_boundary_arn
       instance_types                 = var.initial_instance_types
       min_size                       = var.initial_node_min_size
       max_size                       = var.initial_node_max_size
@@ -243,6 +247,8 @@ module "karpenter" {
   iam_role_use_name_prefix                = false
   node_iam_role_use_name_prefix           = false
   create_pod_identity_association         = false
+  iam_role_permissions_boundary_arn       = local.permissions_boundary_arn
+  node_iam_role_permissions_boundary      = local.permissions_boundary_arn
   iam_role_source_assume_policy_documents = [data.aws_iam_policy_document.source.json]
   tags = merge(var.stack_tags, {
   })
@@ -265,6 +271,7 @@ module "load_balancer_controller_irsa_role" {
       namespace_service_accounts = ["alb:aws-load-balancer-controller"]
     }
   }
+  permissions_boundary = local.permissions_boundary_arn
   tags = merge(var.stack_tags, {
   })
 }
@@ -285,6 +292,7 @@ module "ebs_csi_driver_irsa_role" {
       namespace_service_accounts = ["kube-system:ebs-csi-driver"]
     }
   }
+  permissions_boundary = local.permissions_boundary_arn
   tags = merge(var.stack_tags, {
   })
 }
@@ -329,6 +337,7 @@ module "s3_driver_irsa_role" {
       namespace_service_accounts = ["kube-system:s3-csi-driver"]
     }
   }
+  permissions_boundary = local.permissions_boundary_arn
   tags = merge(var.stack_tags, {
   })
 }
@@ -351,6 +360,7 @@ module "external_dns_irsa_role" {
       namespace_service_accounts = ["external-dns:external-dns-controller"]
     }
   }
+  permissions_boundary = local.permissions_boundary_arn
   tags = merge(var.stack_tags, {
   })
 }
@@ -374,6 +384,7 @@ module "cert_manager_irsa_role" {
       namespace_service_accounts = ["cert-manager:cert-manager"]
     }
   }
+  permissions_boundary = local.permissions_boundary_arn
   tags = merge(var.stack_tags, {
   })
 }

variables.tf

@@ -211,3 +211,9 @@ variable "create_node_security_group" {
   default     = false
   description = "Whether to create a dedicated security group for EKS managed node groups. When true, the node_security_group_id output is populated."
 }
+
+variable "permissions_boundary" {
+  type        = string
+  default     = ""
+  description = "IAM permissions boundary policy name applied to all IAM roles. When set, constructs full ARN from the current account and partition."
+}