feat: Use aws_service_principal data source for deriving IAM service prinicpals

modules/karpenter/main.tf

@@ -12,7 +12,6 @@ data "aws_caller_identity" "current" {
 
 locals {
   account_id = try(data.aws_caller_identity.current[0].account_id, "")
-  dns_suffix = try(data.aws_partition.current[0].dns_suffix, "")
   partition  = try(data.aws_partition.current[0].partition, "")
   region     = try(data.aws_region.current[0].region, "")
 }
@@ -25,6 +24,10 @@ locals {
   create_iam_role = var.create && var.create_iam_role
 }
 
+data "aws_service_principal" "ec2" {
+  service_name = "ec2"
+}
+
 data "aws_iam_policy_document" "controller_assume_role" {
   count = local.create_iam_role ? 1 : 0
 
@@ -271,7 +274,7 @@ data "aws_iam_policy_document" "node_assume_role" {
 
     principals {
       type        = "Service"
-      identifiers = ["ec2.${local.dns_suffix}"]
+      identifiers = [data.aws_service_principal.ec2.name]
     }
   }
 }

modules/karpenter/policy.tf

@@ -234,7 +234,7 @@ data "aws_iam_policy_document" "controller" {
     condition {
       test     = "StringEquals"
       variable = "iam:PassedToService"
-      values   = distinct(["ec2.${local.dns_suffix}", "ec2.amazonaws.com"])
+      values   = [data.aws_service_principal.ec2.name]
     }
   }