Merge pull request #83 from worldcoin/INFRA-5911-create-short-AWS-LB-Controller-role

INFRA-5911 Fix AWS LB Controller for clusters with long names

Author: danielllek

iam-aws-load-balancer.tf

@@ -343,6 +343,20 @@ resource "aws_iam_role_policy" "aws_load_balancer" {
   policy = data.aws_iam_policy_document.aws_load_balancer.json
 }
 
+resource "aws_iam_role" "aws_lbc" {
+  count              = var.aws_load_balancer_iam_role_enabled ? 1 : 0
+  name               = "aws-lbc-${var.cluster_name}"
+  path               = "/system/"
+  assume_role_policy = data.aws_iam_policy_document.aws_load_balancer_assume_role_policy.json
+}
+
+resource "aws_iam_role_policy" "aws_lbc" {
+  count  = var.aws_load_balancer_iam_role_enabled ? 1 : 0
+  name   = "aws-lbc-${var.cluster_name}"
+  role   = aws_iam_role.aws_lbc[0].id
+  policy = data.aws_iam_policy_document.aws_load_balancer.json
+}
+
 moved {
   from = aws_iam_role.aws_load_balancer
   to   = aws_iam_role.aws_load_balancer[0]

main.tf

@@ -65,13 +65,13 @@ resource "aws_iam_openid_connect_provider" "oidc_provider" {
 }
 
 data "aws_iam_roles" "aws_load_balancer_controller" {
-  name_regex  = "^aws-load-balancer-controller-${var.cluster_name}$"
+  name_regex  = "^(aws-load-balancer-controller|aws-lbc)-${var.cluster_name}$"
   path_prefix = "/system/"
 }
 
 locals {
   aws_load_balancer_controller_role_exists = var.enable_aws_load_balancer_controller_explicit_deny ? length(data.aws_iam_roles.aws_load_balancer_controller.names) > 0 : false
-  aws_load_balancer_controller_role_name   = local.aws_load_balancer_controller_role_exists ? sort(tolist(data.aws_iam_roles.aws_load_balancer_controller.names))[0] : null
+  aws_load_balancer_controller_role_names  = local.aws_load_balancer_controller_role_exists ? toset(data.aws_iam_roles.aws_load_balancer_controller.names) : toset([])
 }
 
 data "aws_iam_policy_document" "aws_load_balancer_controller_explicit_deny" {
@@ -84,14 +84,14 @@ data "aws_iam_policy_document" "aws_load_balancer_controller_explicit_deny" {
 
 resource "aws_iam_policy" "aws_load_balancer_controller_explicit_deny" {
   count  = local.aws_load_balancer_controller_role_exists ? 1 : 0
-  name   = "aws-load-balancer-controller-${var.cluster_name}-explicit-deny-elb"
+  name   = "aws-lbc-${var.cluster_name}-explicit-deny-elb"
   path   = "/system/"
   policy = data.aws_iam_policy_document.aws_load_balancer_controller_explicit_deny.json
 }
 
 resource "aws_iam_role_policy_attachment" "aws_load_balancer_controller_explicit_deny" {
-  count      = local.aws_load_balancer_controller_role_exists ? 1 : 0
-  role       = local.aws_load_balancer_controller_role_name
+  for_each   = local.aws_load_balancer_controller_role_names
+  role       = each.value
   policy_arn = aws_iam_policy.aws_load_balancer_controller_explicit_deny[0].arn
 }
-  
+  

variables.tf

@@ -7,8 +7,8 @@ variable "cluster_name" {
   description = "The name of the cluster. Has to be unique per region per account."
   type        = string
   validation {
-    condition     = can(regex("\\w-", var.cluster_name))
-    error_message = "Cluster name must be lowercase alphanumeric characters"
+    condition     = can(regex("^[a-z0-9]([a-z0-9-]*[a-z0-9])?$", var.cluster_name)) && length(var.cluster_name) <= 48
+    error_message = "Cluster name must contain only lowercase alphanumeric characters or hyphens and be at most 48 characters long"
   }
 }