Skip to content

Commit bb2a465

Browse files
bryantbiggsbryantbiggs
committed
chore: Add variable/output changes to upgrade guide
1 parent f4a5642 commit bb2a465

File tree

11 files changed

+295
-2
lines changed

11 files changed

+295
-2
lines changed

‎.pre-commit-config.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ repos:
2424
- '--args=--only=terraform_workspace_remote'
2525
- id: terraform_validate
2626
- repo: https://github.com/pre-commit/pre-commit-hooks
27-
rev: v5.0.0
27+
rev: v6.0.0
2828
hooks:
2929
- id: check-merge-conflict
3030
- id: end-of-file-fixer

‎README.md

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -192,6 +192,10 @@ module "iam_role_saml" {
192192

193193
### IAM Role for EKS Service Accounts (IRSA)
194194

195+
> [!TIP]
196+
> Upgrade to use EKS Pod Identity instead of IRSA
197+
> A similar module for EKS Pod Identity is available [here](https://github.com/terraform-aws-modules/terraform-aws-eks-pod-identity).
198+
195199
Creates an IAM role that is suitable for EKS IAM role for service accounts (IRSA) with a set of pre-defined policies for common EKS addons.
196200

197201
```hcl

‎docs/UPGRADE-6.0.md

Lines changed: 93 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,8 @@ If you find a bug, please open an issue with supporting configuration to reprodu
66

77
## List of backwards incompatible changes
88

9+
- `iam-account`:
10+
- The `aws_caller_identity` data source and associated outputs have been removed. Users should instead use the data source directly in their configuration
911
- `iam-assumable-role` has been renamed to `iam-role`
1012
- `iam-assumable-role-with-oidc` has been merged into `iam-role`
1113
- `iam-assumable-role-with-saml` has been merged into `iam-role`
@@ -17,6 +19,10 @@ If you find a bug, please open an issue with supporting configuration to reprodu
1719
- `iam-group-with-assumable-roles-policy` has been merged into `iam-group`
1820
- `iam-eks-role` has been removed; `iam-role-for-service-accounts` or [`eks-pod-identity`](https://github.com/terraform-aws-modules/terraform-aws-eks-pod-identity) should be used instead
1921
- `iam-policy` has been removed; the `aws_iam_policy` resource should be used directly instead
22+
- `iam-role-for-service-accounts`:
23+
- Individual policy creation and attachment has been consolidated under one policy creation and attachment
24+
- Default values that enable permissive permissions have been removed; users will need to be explicit about the scope of access (i.e. ARNs) they provide when enabling permissions
25+
- AppMesh policy support has been removed due to service reaching end of support
2026

2127
```mermaid
2228
stateDiagram
@@ -69,6 +75,8 @@ stateDiagram
6975

7076
1. Removed variables:
7177

78+
- `iam-account`
79+
- `get_caller_identity`
7280
- `iam-role`
7381
- `trusted_role_actions`
7482
- `trusted_role_arns`
@@ -85,6 +93,24 @@ stateDiagram
8593
- `iam-group`
8694
- `custom_group_policies`
8795
- `assumable_roles`
96+
- `iam-oidc-provider`
97+
- `additional_thumbprints` - no longer required by GitHub
98+
- `iam-role-for-service-accounts`
99+
- `cluster_autoscaler_cluster_ids` - use `cluster_autoscaler_cluster_names` instead
100+
- `role_name_prefix` - functionality covered under `name`
101+
- `policy_name_prefix` - functionality covered under `policy_name`
102+
- `allow_self_assume_role`
103+
- `attach_karpenter_controller_policy`
104+
- `karpenter_controller_cluster_id`
105+
- `karpenter_controller_cluster_name`
106+
- `karpenter_tag_key`
107+
- `karpenter_controller_ssm_parameter_arns`
108+
- `karpenter_controller_node_iam_role_arns`
109+
- `karpenter_subnet_account_id`
110+
- `karpenter_sqs_queue_arn`
111+
- `enable_karpenter_instance_profile_creation`
112+
- `attach_appmesh_controller_policy`
113+
- `attach_appmesh_envoy_proxy_policy`
88114

89115
2. Renamed variables:
90116

@@ -103,19 +129,52 @@ stateDiagram
103129
- `attach_iam_self_management_policy` -> `create_policy`
104130
- `iam_self_management_policy_name_prefix` -> `policy_name_prefix`
105131
- `aws_account_id` -> `users_account_id`
132+
- `iam-read-only-policy`
133+
- `name_prefix` (string) -> `use_name_prefix` (bool)
134+
- `iam-role-for-service-accounts`
135+
- `create_role` -> `create`
136+
- `role_name` -> `name`
137+
- `role_path` -> `path`
138+
- `role_name_prefix` (string) -> `use_name_prefix` (bool)
139+
- `role_permissions_boundary_arn` -> `permissions_boundary`
140+
- `role_description` -> `description`
141+
- `role_policy_arns` -> `policies`
142+
- `ebs_csi_kms_cmk_ids` -> `ebs_csi_kms_cmk_arns`
143+
- `iam-user`
144+
- `create_user` -> `create`
145+
- `create_iam_user_login_profile` -> `create_login_profile`
146+
- `create_iam_access_key` -> `create_access_key`
147+
- `iam_access_key_status` -> `access_key_status`
148+
- `policy_arns` -> `policies`
149+
- `upload_iam_user_ssh_key` -> `create_ssh_key`
106150

107151
3. Added variables:
108152

153+
- `iam-account`
154+
- `create`
109155
- `iam-role`
110156
- `assume_role_policy_statements` which allows for any number of custom statements to be added to the role's trust policy. This covers the majority of the variables that were removed
111157
- `iam-group`
112158
- `permission_statements` which allows for any number of custom statements to be added to the role's trust policy. This covers the majority of the variables that were removed
113159
- `path`/`policy_path`
114160
- `create_policy`
115161
- `enable_mfa_enforcment`
162+
- `iam-read-only-policy`
163+
- `create`
164+
- `iam-role-for-service-accounts`
165+
- `create_policy`
166+
- `source_policy_documents`
167+
- `override_policy_documents`
168+
- `policy_statements`
169+
- `policy_name`
170+
- `policy_description`
116171

117172
4. Removed outputs:
118173

174+
- `iam-account`
175+
- `caller_identity_account_id`
176+
- `caller_identity_arn`
177+
- `caller_identity_user_id`
119178
- `iam-role`
120179
- `iam_role_path`
121180
- `role_requires_mfa`
@@ -124,6 +183,18 @@ stateDiagram
124183
- `iam-group`
125184
- `assumable_roles`
126185
- `aws_account_id`
186+
- `iam-read-only-policy`
187+
- `description`
188+
- `path`
189+
- `iam-user`
190+
- `pgp_key`
191+
- `keybase_password_decrypt_command`
192+
- `keybase_password_pgp_message`
193+
- `keybase_secret_key_decrypt_command`
194+
- `keybase_secret_key_pgp_message`
195+
- `keybase_ses_smtp_password_v4_decrypt_command`
196+
- `keybase_ses_smtp_password_v4_pgp_message`
197+
- `policy_arns`
127198

128199
5. Renamed outputs:
129200

@@ -140,6 +211,22 @@ stateDiagram
140211
- `group_name` -> `name`
141212
- `group_arn` -> `arn`
142213
- `group_users` -> `users`
214+
- `iam-user`
215+
- `iam_user_arn` -> `arn`
216+
- `iam_user_name` -> `name`
217+
- `iam_user_unique_id` -> `unique_id`
218+
- `iam_user_login_profile_password` -> `login_profile_password`
219+
- `iam_user_login_profile_key_fingerprint` -> `login_profile_key_fingerprint`
220+
- `iam_user_login_profile_encrypted_password` -> `login_profile_encrypted_password`
221+
- `iam_access_key_id` -> `access_key_id`
222+
- `iam_access_key_secret` -> `access_key_secret`
223+
- `iam_access_key_key_fingerprint` -> `access_key_key_fingerprint`
224+
- `iam_access_key_encrypted_secret` -> `access_key_encrypted_secret`
225+
- `iam_access_key_ses_smtp_password_v4` -> `access_key_ses_smtp_password_v4`
226+
- `iam_access_key_encrypted_ses_smtp_password_v4` -> `access_key_encrypted_ses_smtp_password_v4`
227+
- `iam_access_key_status` -> `access_key_status`
228+
- `iam_user_ssh_key_ssh_public_key_id` -> `ssh_key_public_key_id`
229+
- `iam_user_ssh_key_fingerprint` -> `ssh_key_fingerprint`
143230

144231
6. Added outputs:
145232

@@ -149,6 +236,12 @@ stateDiagram
149236

150237
### Diff of before <> after
151238

239+
#### `iam-account`
240+
241+
None
242+
243+
244+
152245
#### `iam-role`
153246

154247
```diff

‎examples/iam-role-for-service-accounts/README.md

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,9 @@
11
# AWS IAM Role for Service Accounts in EKS
22

3+
> [!TIP]
4+
> Upgrade to use EKS Pod Identity instead of IRSA
5+
> A similar module for EKS Pod Identity is available [here](https://github.com/terraform-aws-modules/terraform-aws-eks-pod-identity).
6+
37
Configuration in this directory creates IAM roles that can be assumed by multiple EKS `ServiceAccount`s for various tasks.
48

59
# Usage

‎modules/iam-read-only-policy/README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
### AWS IAM ReadOnly Policy Terraform Module
1+
# AWS IAM ReadOnly Policy Terraform Module
22

33
Creates an IAM policy that allows read-only access to the list of AWS services provided.
44

‎modules/iam-role-for-service-accounts/migrations.tf

Lines changed: 168 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,168 @@
1+
################################################################################
2+
# Migrations: v5.60 -> v6.0
3+
################################################################################
4+
5+
# AWS Gateway Controller
6+
moved {
7+
from = aws_iam_policy.aws_gateway_controller
8+
to = aws_iam_policy.this
9+
}
10+
11+
moved {
12+
from = aws_iam_role_policy_attachment.aws_gateway_controller
13+
to = aws_iam_policy.this
14+
}
15+
16+
# Cert Manager
17+
moved {
18+
from = aws_iam_policy.cert_manager
19+
to = aws_iam_policy.this
20+
}
21+
22+
moved {
23+
from = aws_iam_role_policy_attachment.cert_manager
24+
to = aws_iam_policy.this
25+
}
26+
27+
# Cluster Autoscaler
28+
moved {
29+
from = aws_iam_policy.cluster_autoscaler
30+
to = aws_iam_policy.this
31+
}
32+
33+
moved {
34+
from = aws_iam_role_policy_attachment.cluster_autoscaler
35+
to = aws_iam_policy.this
36+
}
37+
38+
# EBS CSI
39+
moved {
40+
from = aws_iam_policy.ebs_csi
41+
to = aws_iam_policy.this
42+
}
43+
44+
moved {
45+
from = aws_iam_role_policy_attachment.ebs_csi
46+
to = aws_iam_policy.this
47+
}
48+
49+
# EFS CSI
50+
moved {
51+
from = aws_iam_policy.efs_csi
52+
to = aws_iam_policy.this
53+
}
54+
55+
moved {
56+
from = aws_iam_role_policy_attachment.efs_csi
57+
to = aws_iam_policy.this
58+
}
59+
60+
# Mountpoint S3 CSI
61+
moved {
62+
from = aws_iam_policy.mountpoint_s3_csi
63+
to = aws_iam_policy.this
64+
}
65+
66+
moved {
67+
from = aws_iam_role_policy_attachment.mountpoint_s3_csi
68+
to = aws_iam_policy.this
69+
}
70+
71+
# External DNS
72+
moved {
73+
from = aws_iam_policy.external_dns
74+
to = aws_iam_policy.this
75+
}
76+
77+
moved {
78+
from = aws_iam_role_policy_attachment.external_dns
79+
to = aws_iam_policy.this
80+
}
81+
82+
# External Secrets
83+
moved {
84+
from = aws_iam_policy.external_secrets
85+
to = aws_iam_policy.this
86+
}
87+
88+
moved {
89+
from = aws_iam_role_policy_attachment.external_secrets
90+
to = aws_iam_policy.this
91+
}
92+
93+
# FSx OpenZFS CSI
94+
moved {
95+
from = aws_iam_policy.fsx_openzfs_csi
96+
to = aws_iam_policy.this
97+
}
98+
99+
moved {
100+
from = aws_iam_role_policy_attachment.fsx_openzfs_csi
101+
to = aws_iam_policy.this
102+
}
103+
104+
# AWS Load Balancer Controller
105+
moved {
106+
from = aws_iam_policy.load_balancer_controller
107+
to = aws_iam_policy.this
108+
}
109+
110+
moved {
111+
from = aws_iam_role_policy_attachment.load_balancer_controller
112+
to = aws_iam_policy.this
113+
}
114+
115+
# AWS Load Balancer Controller - Target Group Binding Only
116+
moved {
117+
from = aws_iam_policy.load_balancer_controller_targetgroup_only
118+
to = aws_iam_policy.this
119+
}
120+
121+
moved {
122+
from = aws_iam_role_policy_attachment.load_balancer_controller_targetgroup_only
123+
to = aws_iam_policy.this
124+
}
125+
126+
# Amazon Managed Service for Prometheus
127+
moved {
128+
from = aws_iam_policy.amazon_managed_service_prometheus
129+
to = aws_iam_policy.this
130+
}
131+
132+
moved {
133+
from = aws_iam_role_policy_attachment.amazon_managed_service_prometheus
134+
to = aws_iam_policy.this
135+
}
136+
137+
# Node Termination Handler
138+
moved {
139+
from = aws_iam_policy.node_termination_handler
140+
to = aws_iam_policy.this
141+
}
142+
143+
moved {
144+
from = aws_iam_role_policy_attachment.node_termination_handler
145+
to = aws_iam_policy.this
146+
}
147+
148+
# Velero
149+
moved {
150+
from = aws_iam_policy.velero
151+
to = aws_iam_policy.this
152+
}
153+
154+
moved {
155+
from = aws_iam_role_policy_attachment.velero
156+
to = aws_iam_policy.this
157+
}
158+
159+
# VPC CNI
160+
moved {
161+
from = aws_iam_policy.vpc_cni
162+
to = aws_iam_policy.this
163+
}
164+
165+
moved {
166+
from = aws_iam_role_policy_attachment.vpc_cni
167+
to = aws_iam_policy.this
168+
}

‎modules/iam-user/README.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -50,6 +50,7 @@ No modules.
5050
| Name | Type |
5151
|------|------|
5252
| [aws_iam_access_key.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_access_key) | resource |
53+
| [aws_iam_role_policy_attachment.additional](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
5354
| [aws_iam_user.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_user) | resource |
5455
| [aws_iam_user_login_profile.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_user_login_profile) | resource |
5556
| [aws_iam_user_ssh_key.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_user_ssh_key) | resource |
@@ -70,6 +71,7 @@ No modules.
7071
| <a name="input_path"></a> [path](#input\_path) | Desired path for the IAM user | `string` | `"/"` | no |
7172
| <a name="input_permissions_boundary"></a> [permissions\_boundary](#input\_permissions\_boundary) | The ARN of the policy that is used to set the permissions boundary for the user | `string` | `null` | no |
7273
| <a name="input_pgp_key"></a> [pgp\_key](#input\_pgp\_key) | Either a base-64 encoded PGP public key, or a keybase username in the form `keybase:username`. Used to encrypt password and access key | `string` | `null` | no |
74+
| <a name="input_policies"></a> [policies](#input\_policies) | Policies to attach to the IAM user in `{'static_name' = 'policy_arn'}` format | `map(string)` | `{}` | no |
7375
| <a name="input_ssh_key_encoding"></a> [ssh\_key\_encoding](#input\_ssh\_key\_encoding) | Specifies the public key encoding format to use in the response. To retrieve the public key in ssh-rsa format, use SSH. To retrieve the public key in PEM format, use PEM | `string` | `"SSH"` | no |
7476
| <a name="input_ssh_public_key"></a> [ssh\_public\_key](#input\_ssh\_public\_key) | The SSH public key. The public key must be encoded in ssh-rsa format or PEM format | `string` | `""` | no |
7577
| <a name="input_tags"></a> [tags](#input\_tags) | A map of tags to add to all resources | `map(string)` | `{}` | no |

‎modules/iam-user/main.tf

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,13 @@ resource "aws_iam_user" "this" {
1313
tags = var.tags
1414
}
1515

16+
resource "aws_iam_role_policy_attachment" "additional" {
17+
for_each = { for k, v in var.policies : k => v if var.create }
18+
19+
role = aws_iam_user.this[0].name
20+
policy_arn = each.value
21+
}
22+
1623
################################################################################
1724
# User Login Profile
1825
################################################################################

0 commit comments

Comments
 (0)