View SourceRelease Notes

EKS IAM Role Assume Role Policy for Kubernetes Service Accounts

This Terraform module can be used to create Assume Role policies for IAM Roles such that they can be used with Kubernetes Service Accounts. This requires a compatible EKS cluster that supports the IAM Roles for Service Accounts feature.

See the corresponding section of the eks-cluster-control-plane module README for information on how to set up IRSA and how it works.

Reference

Inputs

Required

eks_openid_connect_provider_arnstringrequired

ARN of the OpenID Connect Provider provisioned for the EKS cluster.

eks_openid_connect_provider_urlstringrequired

URL of the OpenID Connect Provider provisioned for the EKS cluster.

namespaceslist(string)required

The Kubernetes Namespaces that are allowed to assume the attached IAM Role. Only one of <a href="#namespaces"><code>namespaces</code></a> or <a href="#service_accounts"><code>service_accounts</code></a> can be set. If both are set, you may end up with an impossible rule! If both are set to null, then this will allow all namespaces and all service accounts.

service_accountslist(object(…))required

The Kubernetes Service Accounts that are allowed to assume the attached IAM Role. Only one of <a href="#namespaces"><code>namespaces</code></a> or <a href="#service_accounts"><code>service_accounts</code></a> can be set. If both are set, you may end up with an impossible rule! If both are set to null, then this will allow all namespaces and all service accounts.

Type Details

list(object({
    name      = string
    namespace = string
  }))

Optional

service_accounts_condition_operatorstringoptional

The string operator to use when evaluating the AWS IAM condition for determining which Service Accounts are allowed to assume the IAM role. Examples: StringEquals, StringLike, etc.

Default:"StringEquals"

Outputs

assume_role_policy_json

JSON value for IAM Role Assume Role Policy that allows Kubernetes Service Account to inherit IAM Role.