iam_policy.tf

##################################################################################
# RESOURCES
##################################################################################

# IAM Role

resource "aws_iam_role" "k8s-iam-role" {
  name  = "k8s_iam_role"
  assume_role_policy = <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": "sts:AssumeRole",
      "Principal": {
        "Service": "ec2.amazonaws.com"
      },
      "Effect": "Allow",
      "Sid": ""
    }
  ]
}
EOF
}


resource "aws_iam_policy" "k8s-iam-policy" {
  name  = "k8s_iam_policy"
  description = "Allow K8s to start an ELB, and allocate storage."
  policy      = <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "s3:*",
      "Resource": [
        "arn:aws:s3:::kubernetes-*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": "ec2:Describe*",
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": "ec2:AttachVolume",
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": "ec2:DetachVolume",
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": ["ec2:*"],
      "Resource": ["*"]
    },
    {
      "Effect": "Allow",
      "Action": ["elasticloadbalancing:*"],
      "Resource": ["*"]
    },
    {
        "Effect": "Allow",
        "Action": [
            "route53:ChangeResourceRecordSets",
            "route53:GetChange",
            "route53:GetHostedZone",
            "route53:ListHostedZones",
            "route53:ListHostedZonesByName",
            "route53:ListResourceRecordSets"
        ],
        "Resource": [
            "*"
        ]
    },
    {
        "Effect": "Allow",
        "Action": [
            "acm:DescribeCertificate"
        ],
        "Resource": "*"
    }
  ]
}
EOF
}


resource "aws_iam_policy_attachment" "k8s-iam-policy-attachment" {
  name  = "k8s_iam_policy_attachment"
  roles      = ["${aws_iam_role.k8s-iam-role.name}"]
  policy_arn = "${aws_iam_policy.k8s-iam-policy.arn}"
}


resource "aws_iam_instance_profile" "aws-iam-k8s-instance-profile" {
  name  = "aws_iam_k8s_instance_profile"
  role = "${aws_iam_role.k8s-iam-role.name}"
}