Skip to content

Commit e528d88

Browse files
bryantbiggsbryantbiggs
committed
fix: Correct IAM policy statement variables
1 parent 2d9d213 commit e528d88

File tree

26 files changed

+116
-126
lines changed

26 files changed

+116
-126
lines changed

‎.pre-commit-config.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
repos:
22
- repo: https://github.com/antonbabenko/pre-commit-terraform
3-
rev: v1.99.5
3+
rev: v1.100.0
44
hooks:
55
- id: terraform_fmt
66
- id: terraform_wrapper_module_for_each

‎examples/iam-account/README.md

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -44,6 +44,5 @@ No inputs.
4444

4545
| Name | Description |
4646
|------|-------------|
47-
| <a name="output_caller_identity_account_id"></a> [caller\_identity\_account\_id](#output\_caller\_identity\_account\_id) | The ID of the AWS account |
4847
| <a name="output_iam_account_password_policy_expire_passwords"></a> [iam\_account\_password\_policy\_expire\_passwords](#output\_iam\_account\_password\_policy\_expire\_passwords) | Indicates whether passwords in the account expire. Returns true if max\_password\_age contains a value greater than 0. Returns false if it is 0 or not present. |
4948
<!-- END_TF_DOCS -->

‎examples/iam-account/main.tf

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,9 +2,10 @@ provider "aws" {
22
region = "eu-west-1"
33
}
44

5-
##############
5+
################################################################################
66
# IAM account
7-
##############
7+
################################################################################
8+
89
module "iam_account" {
910
source = "../../modules/iam-account"
1011

‎examples/iam-account/outputs.tf

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,3 @@
1-
output "caller_identity_account_id" {
2-
description = "The ID of the AWS account"
3-
value = module.iam_account.caller_identity_account_id
4-
}
5-
61
output "iam_account_password_policy_expire_passwords" {
72
description = "Indicates whether passwords in the account expire. Returns true if max_password_age contains a value greater than 0. Returns false if it is 0 or not present."
83
value = module.iam_account.iam_account_password_policy_expire_passwords

‎examples/iam-group/main.tf

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -26,13 +26,12 @@ module "iam_group" {
2626
module.iam_user2.name,
2727
]
2828

29-
permission_statements = [
30-
{
31-
sid = "AssumeRole"
29+
permission_statements = {
30+
AssumeRole = {
3231
actions = ["sts:AssumeRole"]
3332
resources = ["arn:aws:iam::111111111111:role/admin"]
3433
}
35-
]
34+
}
3635

3736
policies = {
3837
ReadOnlyAccess = "arn:aws:iam::aws:policy/ReadOnlyAccess"

‎examples/iam-role-for-service-accounts/README.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,7 @@ Run `terraform destroy` when you don't need these resources.
4141
| <a name="module_ebs_csi_irsa"></a> [ebs\_csi\_irsa](#module\_ebs\_csi\_irsa) | ../../modules/iam-role-for-service-accounts | n/a |
4242
| <a name="module_ebs_csi_irsa_v2"></a> [ebs\_csi\_irsa\_v2](#module\_ebs\_csi\_irsa\_v2) | ../../modules/iam-role-for-service-accounts | n/a |
4343
| <a name="module_efs_csi_irsa"></a> [efs\_csi\_irsa](#module\_efs\_csi\_irsa) | ../../modules/iam-role-for-service-accounts | n/a |
44-
| <a name="module_eks"></a> [eks](#module\_eks) | terraform-aws-modules/eks/aws | ~> 19.10 |
44+
| <a name="module_eks"></a> [eks](#module\_eks) | terraform-aws-modules/eks/aws | ~> 21.0 |
4545
| <a name="module_external_dns_irsa"></a> [external\_dns\_irsa](#module\_external\_dns\_irsa) | ../../modules/iam-role-for-service-accounts | n/a |
4646
| <a name="module_external_secrets_irsa"></a> [external\_secrets\_irsa](#module\_external\_secrets\_irsa) | ../../modules/iam-role-for-service-accounts | n/a |
4747
| <a name="module_fsx_lustre_csi_irsa"></a> [fsx\_lustre\_csi\_irsa](#module\_fsx\_lustre\_csi\_irsa) | ../../modules/iam-role-for-service-accounts | n/a |
@@ -53,7 +53,7 @@ Run `terraform destroy` when you don't need these resources.
5353
| <a name="module_load_balancer_controller_targetgroup_binding_only_irsa"></a> [load\_balancer\_controller\_targetgroup\_binding\_only\_irsa](#module\_load\_balancer\_controller\_targetgroup\_binding\_only\_irsa) | ../../modules/iam-role-for-service-accounts | n/a |
5454
| <a name="module_node_termination_handler_irsa"></a> [node\_termination\_handler\_irsa](#module\_node\_termination\_handler\_irsa) | ../../modules/iam-role-for-service-accounts | n/a |
5555
| <a name="module_velero_irsa"></a> [velero\_irsa](#module\_velero\_irsa) | ../../modules/iam-role-for-service-accounts | n/a |
56-
| <a name="module_vpc"></a> [vpc](#module\_vpc) | terraform-aws-modules/vpc/aws | ~> 3.0 |
56+
| <a name="module_vpc"></a> [vpc](#module\_vpc) | terraform-aws-modules/vpc/aws | ~> 6.0 |
5757
| <a name="module_vpc_cni_ipv4_irsa"></a> [vpc\_cni\_ipv4\_irsa](#module\_vpc\_cni\_ipv4\_irsa) | ../../modules/iam-role-for-service-accounts | n/a |
5858
| <a name="module_vpc_cni_ipv6_irsa"></a> [vpc\_cni\_ipv6\_irsa](#module\_vpc\_cni\_ipv6\_irsa) | ../../modules/iam-role-for-service-accounts | n/a |
5959

‎examples/iam-role-for-service-accounts/main.tf

Lines changed: 25 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -48,14 +48,13 @@ module "irsa_v2_custom_policy" {
4848
name = "${local.name}-custom-name"
4949

5050
enable_irsa_v2 = true
51-
policy_statements = [
52-
{
53-
sid = "DescribeEc2"
51+
policy_statements = {
52+
DescribeEc2 = {
5453
actions = ["ec2:Describe*"]
5554
effect = "Allow"
5655
resources = ["*"]
5756
}
58-
]
57+
}
5958

6059
tags = local.tags
6160
}
@@ -399,7 +398,7 @@ module "vpc_cni_ipv6_irsa" {
399398

400399
module "vpc" {
401400
source = "terraform-aws-modules/vpc/aws"
402-
version = "~> 3.0"
401+
version = "~> 6.0"
403402

404403
name = local.name
405404
cidr = local.vpc_cidr
@@ -408,9 +407,8 @@ module "vpc" {
408407
private_subnets = [for k, v in local.azs : cidrsubnet(local.vpc_cidr, 4, k)]
409408
public_subnets = [for k, v in local.azs : cidrsubnet(local.vpc_cidr, 8, k + 48)]
410409

411-
enable_nat_gateway = true
412-
single_nat_gateway = true
413-
enable_dns_hostnames = true
410+
enable_nat_gateway = true
411+
single_nat_gateway = true
414412

415413
public_subnet_tags = {
416414
"kubernetes.io/role/elb" = 1
@@ -425,16 +423,31 @@ module "vpc" {
425423

426424
module "eks" {
427425
source = "terraform-aws-modules/eks/aws"
428-
version = "~> 19.10"
426+
version = "~> 21.0"
429427

430-
cluster_name = local.name
431-
cluster_version = "1.25"
428+
name = local.name
429+
kubernetes_version = "1.33"
432430

433431
vpc_id = module.vpc.vpc_id
434432
subnet_ids = module.vpc.private_subnets
435433

434+
addons = {
435+
coredns = {}
436+
kube-proxy = {}
437+
vpc-cni = {
438+
before_compute = true
439+
}
440+
}
441+
436442
eks_managed_node_groups = {
437-
default = {}
443+
example = {
444+
ami_type = "AL2023_x86_64_STANDARD"
445+
instance_types = ["m5.xlarge"]
446+
447+
min_size = 1
448+
max_size = 2
449+
desired_size = 1
450+
}
438451
}
439452

440453
tags = local.tags

‎examples/iam-role-for-service-accounts/outputs.tf

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@ output "irsa_unique_id" {
2121
description = "Unique ID of IAM role"
2222
value = module.irsa.unique_id
2323
}
24+
2425
################################################################################
2526
# IAM Policy
2627
################################################################################

‎examples/iam-role-saml/main.tf

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -45,11 +45,13 @@ module "iam_roles" {
4545
}
4646
}
4747
poweruser = {
48-
PowerUserAccess = "arn:aws:iam::aws:policy/PowerUserAccess"
48+
policies = {
49+
PowerUserAccess = "arn:aws:iam::aws:policy/PowerUserAccess"
50+
}
4951
}
5052
}
5153

52-
name_prefix = "${each.key}-"
54+
name = each.key
5355

5456
saml_provider_ids = [aws_iam_saml_provider.this.id]
5557
policies = each.value.policies

‎examples/iam-role/README.md

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@ Run `terraform destroy` when you don't need these resources.
3232

3333
| Name | Source | Version |
3434
|------|--------|---------|
35-
| <a name="module_iam_role_conditions"></a> [iam\_role\_conditions](#module\_iam\_role\_conditions) | ../../modules/iam-role | n/a |
35+
| <a name="module_iam_role_condition"></a> [iam\_role\_condition](#module\_iam\_role\_condition) | ../../modules/iam-role | n/a |
3636
| <a name="module_iam_role_disabled"></a> [iam\_role\_disabled](#module\_iam\_role\_disabled) | ../../modules/iam-role | n/a |
3737
| <a name="module_iam_role_instance_profile"></a> [iam\_role\_instance\_profile](#module\_iam\_role\_instance\_profile) | ../../modules/iam-role | n/a |
3838
| <a name="module_iam_roles"></a> [iam\_roles](#module\_iam\_roles) | ../../modules/iam-role | n/a |
@@ -52,13 +52,13 @@ No inputs.
5252

5353
| Name | Description |
5454
|------|-------------|
55-
| <a name="output_conditions_iam_instance_profile_arn"></a> [conditions\_iam\_instance\_profile\_arn](#output\_conditions\_iam\_instance\_profile\_arn) | ARN assigned by AWS to the instance profile |
56-
| <a name="output_conditions_iam_instance_profile_id"></a> [conditions\_iam\_instance\_profile\_id](#output\_conditions\_iam\_instance\_profile\_id) | Instance profile's ID |
57-
| <a name="output_conditions_iam_instance_profile_name"></a> [conditions\_iam\_instance\_profile\_name](#output\_conditions\_iam\_instance\_profile\_name) | Name of IAM instance profile |
58-
| <a name="output_conditions_iam_instance_profile_unique_id"></a> [conditions\_iam\_instance\_profile\_unique\_id](#output\_conditions\_iam\_instance\_profile\_unique\_id) | Stable and unique string identifying the IAM instance profile |
59-
| <a name="output_conditions_iam_role_arn"></a> [conditions\_iam\_role\_arn](#output\_conditions\_iam\_role\_arn) | The Amazon Resource Name (ARN) specifying the IAM role |
60-
| <a name="output_conditions_iam_role_name"></a> [conditions\_iam\_role\_name](#output\_conditions\_iam\_role\_name) | The name of the IAM role |
61-
| <a name="output_conditions_iam_role_unique_id"></a> [conditions\_iam\_role\_unique\_id](#output\_conditions\_iam\_role\_unique\_id) | Stable and unique string identifying the IAM role |
55+
| <a name="output_condition_iam_instance_profile_arn"></a> [condition\_iam\_instance\_profile\_arn](#output\_condition\_iam\_instance\_profile\_arn) | ARN assigned by AWS to the instance profile |
56+
| <a name="output_condition_iam_instance_profile_id"></a> [condition\_iam\_instance\_profile\_id](#output\_condition\_iam\_instance\_profile\_id) | Instance profile's ID |
57+
| <a name="output_condition_iam_instance_profile_name"></a> [condition\_iam\_instance\_profile\_name](#output\_condition\_iam\_instance\_profile\_name) | Name of IAM instance profile |
58+
| <a name="output_condition_iam_instance_profile_unique_id"></a> [condition\_iam\_instance\_profile\_unique\_id](#output\_condition\_iam\_instance\_profile\_unique\_id) | Stable and unique string identifying the IAM instance profile |
59+
| <a name="output_condition_iam_role_arn"></a> [condition\_iam\_role\_arn](#output\_condition\_iam\_role\_arn) | The Amazon Resource Name (ARN) specifying the IAM role |
60+
| <a name="output_condition_iam_role_name"></a> [condition\_iam\_role\_name](#output\_condition\_iam\_role\_name) | The name of the IAM role |
61+
| <a name="output_condition_iam_role_unique_id"></a> [condition\_iam\_role\_unique\_id](#output\_condition\_iam\_role\_unique\_id) | Stable and unique string identifying the IAM role |
6262
| <a name="output_instance_profile_iam_instance_profile_arn"></a> [instance\_profile\_iam\_instance\_profile\_arn](#output\_instance\_profile\_iam\_instance\_profile\_arn) | ARN assigned by AWS to the instance profile |
6363
| <a name="output_instance_profile_iam_instance_profile_id"></a> [instance\_profile\_iam\_instance\_profile\_id](#output\_instance\_profile\_iam\_instance\_profile\_id) | Instance profile's ID |
6464
| <a name="output_instance_profile_iam_instance_profile_name"></a> [instance\_profile\_iam\_instance\_profile\_name](#output\_instance\_profile\_iam\_instance\_profile\_name) | Name of IAM instance profile |

0 commit comments

Comments
 (0)