Skip to content

Commit

Permalink
Create EKS admins group
Browse files Browse the repository at this point in the history
  • Loading branch information
@keyvaann
keyvaann committed Dec 11, 2024
1 parent 8fd4433 commit b1842ae
Show file tree
Hide file tree
Showing 5 changed files with 38 additions and 7 deletions.
13 changes: 12 additions & 1 deletion README.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -75,11 +75,22 @@ Created resources:
- KMS keys and CloudWatch log groups
- Essential IAM policies, roles, users and user groups for accessing aforementioned resources

## Crete an AWS profile with EKS admin role

Before accessing the cluster you need to create a new profile in your AWS configuration that uses the role that has been created.
Copy this this to your AWS configuration file typically located at `~/.aws/config`

```
[profile eks-admin]
role_arn = # Put result of the `terraform output assume_eks_admins_role` in here.
source_profile = # Source profile in AWS config that is a user defined in `eks_admins_group_users` input value.
```

## Connect to and verify the cluster

```
# Make sure to use --region if the cluster is deployed in non-default region and --profile if the cluster is deployed in a non-default AWS account
aws eks update-kubeconfig --name [eks_cluster_name]
aws --profile eks-admin eks update-kubeconfig --name [eks_cluster_name]
kubectl get nodes
kubectl get pods -A
```
Expand Down
10 changes: 7 additions & 3 deletions cluster/README.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -32,10 +32,12 @@

| Name | Type |
|------|------|
| [aws_iam_group.eks_admins_group](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_group) | resource |
| [aws_iam_group_membership.eks_admins_group_membership](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_group_membership) | resource |
| [aws_iam_group_policy_attachment.eks_admins_policy_attachment](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_group_policy_attachment) | resource |
| [aws_iam_policy.ecr_access](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
| [aws_iam_policy.ecr_pull_through_cache](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
| [aws_iam_policy.s3_access](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
| [aws_iam_policy_attachment.eks_admins_policy_attachment](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy_attachment) | resource |
| [aws_security_group.vpc_endpoint](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group) | resource |
| [aws_security_group_rule.vpc_endpoint_egress](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group_rule) | resource |
| [aws_security_group_rule.vpc_endpoint_self_ingress](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group_rule) | resource |
Expand All @@ -51,9 +53,10 @@

| Name | Description | Type | Default | Required |
|------|-------------|------|---------|:--------:|
| <a name="input_AWS_ACCESS_KEY_ID"></a> [AWS\_ACCESS\_KEY\_ID](#input\_AWS\_ACCESS\_KEY\_ID) | AWS access key associated with an IAM account | `string` | n/a | yes |
| <a name="input_AWS_ACCESS_KEY_ID"></a> [AWS\_ACCESS\_KEY\_ID](#input\_AWS\_ACCESS\_KEY\_ID) | AWS access key associated with an IAM account | `string` | `""` | no |
| <a name="input_AWS_PROFILE"></a> [AWS\_PROFILE](#input\_AWS\_PROFILE) | AWS Profile that resources are created in | `string` | `"default"` | no |
| <a name="input_AWS_REGION"></a> [AWS\_REGION](#input\_AWS\_REGION) | Target AWS region | `string` | `"eu-west-2"` | no |
| <a name="input_AWS_SECRET_ACCESS_KEY"></a> [AWS\_SECRET\_ACCESS\_KEY](#input\_AWS\_SECRET\_ACCESS\_KEY) | AWS secret key associated with the access key | `string` | n/a | yes |
| <a name="input_AWS_SECRET_ACCESS_KEY"></a> [AWS\_SECRET\_ACCESS\_KEY](#input\_AWS\_SECRET\_ACCESS\_KEY) | AWS secret key associated with the access key | `string` | `""` | no |
| <a name="input_AWS_SESSION_TOKEN"></a> [AWS\_SESSION\_TOKEN](#input\_AWS\_SESSION\_TOKEN) | Session token for temporary security credentials from AWS STS | `string` | `""` | no |
| <a name="input_common_tags"></a> [common\_tags](#input\_common\_tags) | Common tags associated to resources created | `map(string)` | <pre>{<br> "Environment": "dev",<br> "Project": "radar-base"<br>}</pre> | no |
| <a name="input_create_dmz_node_group"></a> [create\_dmz\_node\_group](#input\_create\_dmz\_node\_group) | Whether or not to create a DMZ node group with taints | `bool` | `false` | no |
Expand All @@ -71,6 +74,7 @@

| Name | Description |
|------|-------------|
| <a name="output_assume_eks_admins_role"></a> [assume\_eks\_admins\_role](#output\_assume\_eks\_admins\_role) | n/a |
| <a name="output_radar_base_ebs_storage_class_gp2"></a> [radar\_base\_ebs\_storage\_class\_gp2](#output\_radar\_base\_ebs\_storage\_class\_gp2) | n/a |
| <a name="output_radar_base_ebs_storage_class_gp3"></a> [radar\_base\_ebs\_storage\_class\_gp3](#output\_radar\_base\_ebs\_storage\_class\_gp3) | n/a |
| <a name="output_radar_base_ebs_storage_class_io1"></a> [radar\_base\_ebs\_storage\_class\_io1](#output\_radar\_base\_ebs\_storage\_class\_io1) | n/a |
Expand Down
17 changes: 14 additions & 3 deletions cluster/iam.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -82,10 +82,21 @@ module "allow_assume_eks_admins_iam_policy" {
tags = merge(tomap({ "Name" : "${var.eks_cluster_name}-allow-assume-eks-admin-role" }), var.common_tags)
}

resource "aws_iam_policy_attachment" "eks_admins_policy_attachment" {
name = "${var.eks_cluster_name}-eks-admins-policy-attachment"
resource "aws_iam_group" "eks_admins_group" {
name = "${var.eks_cluster_name}-admins"
path = "/${var.eks_cluster_name}/"
}

resource "aws_iam_group_policy_attachment" "eks_admins_policy_attachment" {
group = "${var.eks_cluster_name}-admins"
policy_arn = module.allow_assume_eks_admins_iam_policy.arn
users = var.eks_admins_group_users
}

resource "aws_iam_group_membership" "eks_admins_group_membership" {
name = "${var.eks_cluster_name}-admin-users"

users = var.eks_admins_group_users
group = "${var.eks_cluster_name}-admins"
}

module "iam_user" {
Expand Down
4 changes: 4 additions & 0 deletions cluster/outputs.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -37,3 +37,7 @@ output "radar_base_ebs_storage_class_io1" {
output "radar_base_ebs_storage_class_io2" {
value = local.storage_classes.io2
}

output "assume_eks_admins_role" {
value = module.allow_assume_eks_admins_iam_policy.arn
}
1 change: 1 addition & 0 deletions config/README.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -85,6 +85,7 @@
| Name | Description | Type | Default | Required |
|------|-------------|------|---------|:--------:|
| <a name="input_AWS_ACCESS_KEY_ID"></a> [AWS\_ACCESS\_KEY\_ID](#input\_AWS\_ACCESS\_KEY\_ID) | AWS access key associated with an IAM account | `string` | n/a | yes |
| <a name="input_AWS_PROFILE"></a> [AWS\_PROFILE](#input\_AWS\_PROFILE) | AWS Profile that resources are created in | `string` | `"default"` | no |
| <a name="input_AWS_REGION"></a> [AWS\_REGION](#input\_AWS\_REGION) | Target AWS region | `string` | `"eu-west-2"` | no |
| <a name="input_AWS_SECRET_ACCESS_KEY"></a> [AWS\_SECRET\_ACCESS\_KEY](#input\_AWS\_SECRET\_ACCESS\_KEY) | AWS secret key associated with the access key | `string` | n/a | yes |
| <a name="input_AWS_SESSION_TOKEN"></a> [AWS\_SESSION\_TOKEN](#input\_AWS\_SESSION\_TOKEN) | Session token for temporary security credentials from AWS STS | `string` | `""` | no |
Expand Down

0 comments on commit b1842ae

Please sign in to comment.