-
Notifications
You must be signed in to change notification settings - Fork 0
/
iam_alb.tf
116 lines (92 loc) · 3.21 KB
/
iam_alb.tf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
data "aws_iam_policy_document" "aws_load_balancer_controller_assume_role" {
statement {
actions = ["sts:AssumeRoleWithWebIdentity"]
effect = "Allow"
condition {
test = "StringEquals"
variable = "${replace(aws_iam_openid_connect_provider.eks.url, "https://", "")}:sub"
values = ["system:serviceaccount:kube-system:aws-load-balancer-controller"]
}
principals {
identifiers = [aws_iam_openid_connect_provider.eks.arn]
type = "Federated"
}
}
}
resource "aws_iam_role" "alb_controller" {
assume_role_policy = data.aws_iam_policy_document.aws_load_balancer_controller_assume_role.json
name = format("%s-alb-controller", var.cluster_name)
}
data "aws_iam_policy_document" "aws_load_balancer_controller_policy" {
version = "2012-10-17"
statement {
effect = "Allow"
actions = [
"iam:CreateServiceLinkedRole",
"ec2:DescribeAccountAttributes",
"ec2:DescribeAddresses",
"ec2:DescribeAvailabilityZones",
"ec2:DescribeInternetGateways",
"ec2:DescribeVpcs",
"ec2:DescribeSubnets",
"ec2:DescribeSecurityGroups",
"ec2:DescribeInstances",
"ec2:DescribeNetworkInterfaces",
"ec2:DescribeTags",
"ec2:GetCoipPoolUsage",
"ec2:DescribeCoipPools",
"elasticloadbalancing:DescribeLoadBalancers",
"elasticloadbalancing:DescribeLoadBalancerAttributes",
"elasticloadbalancing:DescribeListeners",
"elasticloadbalancing:DescribeListenerCertificates",
"elasticloadbalancing:DescribeSSLPolicies",
"elasticloadbalancing:DescribeRules",
"elasticloadbalancing:DescribeTargetGroups",
"elasticloadbalancing:DescribeTargetGroupAttributes",
"elasticloadbalancing:DescribeTargetHealth",
"elasticloadbalancing:DescribeTags",
"elasticloadbalancing:SetWebAcl",
"elasticloadbalancing:ModifyListener",
"elasticloadbalancing:AddListenerCertificates",
"elasticloadbalancing:RemoveListenerCertificates",
"elasticloadbalancing:ModifyRule"
]
resources = [
"*"
]
}
statement {
effect = "Allow"
actions = [
"elasticloadbalancing:RegisterTargets",
"elasticloadbalancing:DeregisterTargets"
]
resources = [
"arn:aws:elasticloadbalancing:*:*:targetgroup/*/*"
]
}
statement {
effect = "Allow"
actions = [
"elasticloadbalancing:AddTags",
"elasticloadbalancing:RemoveTags"
]
resources = [
"arn:aws:elasticloadbalancing:*:*:listener/net/*/*/*",
"arn:aws:elasticloadbalancing:*:*:listener/app/*/*/*",
"arn:aws:elasticloadbalancing:*:*:listener-rule/net/*/*/*",
"arn:aws:elasticloadbalancing:*:*:listener-rule/app/*/*/*"
]
}
}
resource "aws_iam_policy" "aws_load_balancer_controller_policy" {
name = format("%s-alb-controller-policy", var.cluster_name)
path = "/"
description = var.cluster_name
policy = data.aws_iam_policy_document.aws_load_balancer_controller_policy.json
}
resource "aws_iam_policy_attachment" "aws_load_balancer_controller_policy" {
name = "aws_load_balancer_controller_policy"
roles = [aws_iam_role.alb_controller.name]
policy_arn = aws_iam_policy.aws_load_balancer_controller_policy.arn
}