AWS EKS Pod Identity Terraform module

Version2.9.0

Upstream version 2.9.0

0 controls from CISA Cyber Essentials requirements

Terraform Module Source

cisacyberessentials.compliance.tf/terraform-aws-modules/eks-pod-identity/aws

Compliance Inputs Outputs Resources Rules Diff (0)README

82 unique

Name	Type	Default	Description
Optional
additional_policy_arns	map(string)	{}	ARNs of additional policies to attach to the IAM role
amazon_managed_service_prometheus_policy_name	string	null	Custom name of the Amazon Managed Service for Prometheus IAM policy
amazon_managed_service_prometheus_workspace_arns	list(string)	[]	List of AMP Workspace ARNs to read and write metrics
appmesh_controller_policy_name	string	null	Custom name of the AppMesh Controller IAM policy
appmesh_envoy_proxy_policy_name	string	null	Custom name of the AppMesh Envoy Proxy IAM policy
association_defaults	object({...})	{}	Default values used across all Pod Identity associations created unless a more specific value is provided
associations	map({...})	{}	Map of Pod Identity associations to be created (map of maps)
attach_amazon_managed_service_prometheus_policy	bool	false	Determines whether to attach the Amazon Managed Service for Prometheus IAM policy to the role
attach_aws_appmesh_controller_policy	bool	false	Determines whether to attach the AppMesh Controller policy to the role
attach_aws_appmesh_envoy_proxy_policy	bool	false	Determines whether to attach the AppMesh Envoy Proxy policy to the role
attach_aws_cloudwatch_observability_policy	bool	false	Determines whether to attach the AWS Cloudwatch Observability IAM policy to the role
attach_aws_ebs_csi_policy	bool	false	Determines whether to attach the EBS CSI IAM policy to the role
attach_aws_efs_csi_policy	bool	false	Determines whether to attach the EFS CSI IAM policy to the role
attach_aws_fsx_lustre_csi_policy	bool	false	Determines whether to attach the FSx for Lustre CSI Driver IAM policy to the role
attach_aws_gateway_controller_policy	bool	false	Determines whether to attach the AWS Gateway Controller IAM policy to the role
attach_aws_global_accelerator_controller_policy	bool	false	Determines whether to attach the AWS Global Accelerator Controller policy to the role
attach_aws_lb_controller_policy	bool	false	Determines whether to attach the AWS Load Balancer Controller policy to the role
attach_aws_lb_controller_targetgroup_binding_only_policy	bool	false	Determines whether to attach the AWS Load Balancer Controller policy for the TargetGroupBinding only
attach_aws_node_termination_handler_policy	bool	false	Determines whether to attach the Node Termination Handler policy to the role
attach_aws_privateca_issuer_policy	bool	false	Determines whether to attach the AWS Private CA Issuer IAM policy to the role
attach_aws_vpc_cni_policy	bool	false	Determines whether to attach the VPC CNI IAM policy to the role
attach_cert_manager_policy	bool	false	Determines whether to attach the Cert Manager IAM policy to the role
attach_cluster_autoscaler_policy	bool	false	Determines whether to attach the Cluster Autoscaler IAM policy to the role
attach_custom_policy	bool	false	Determines whether to attach the custom IAM policy to the role
attach_external_dns_policy	bool	false	Determines whether to attach the External DNS IAM policy to the role
attach_external_secrets_policy	bool	false	Determines whether to attach the External Secrets policy to the role
attach_mountpoint_s3_csi_policy	bool	false	Determines whether to attach the Mountpoint S3 CSI IAM policy to the role
attach_pganalyze_policy	bool	false	Determines whether to attach the PGAnalyze IAM policy to the role
attach_velero_policy	bool	false	Determines whether to attach the Velero IAM policy to the role
aws_ebs_csi_kms_arns	list(string)	[]	KMS key ARNs to allow EBS CSI to manage encrypted volumes
aws_ebs_csi_policy_name	string	null	Custom name of the EBS CSI IAM policy
aws_efs_csi_policy_name	string	null	Custom name of the EFS CSI IAM policy
aws_fsx_lustre_csi_policy_name	string	null	Custom name of the FSx for Lustre CSI Driver IAM policy
aws_fsx_lustre_csi_service_role_arns	list(string)	[]	Service role ARNs to allow FSx for Lustre CSI create and manage FSX for Lustre service linked roles
aws_gateway_controller_policy_name	string	null	Custom name of the AWS Gateway Controller IAM policy
aws_global_accelerator_controller_policy_name	string	null	Custom name of the AWS Global Accelerator Controller IAM policy
aws_lb_controller_policy_name	string	null	Custom name of the AWS Load Balancer Controller IAM policy
aws_lb_controller_targetgroup_arns	list(string)	[]	List of Target groups ARNs using Load Balancer Controller
aws_lb_controller_targetgroup_only_policy_name	string	null	Custom name of the AWS Load Balancer Controller IAM policy for the TargetGroupBinding only
aws_node_termination_handler_policy_name	string	null	Custom name of the Node Termination Handler IAM policy
aws_node_termination_handler_sqs_queue_arns	list(string)	[]	List of SQS ARNs that contain node termination events
aws_privateca_issuer_acmca_arns	list(string)	[]	List of ACM Private CA ARNs to issue certificates from
aws_privateca_issuer_policy_name	string	null	Custom name of the AWS Private CA Issuer IAM policy
aws_vpc_cni_enable_cloudwatch_logs	bool	false	Determines whether to enable VPC CNI permission to create CloudWatch Log groups and publish network policy events
aws_vpc_cni_enable_ipv4	bool	false	Determines whether to enable IPv4 permissions for VPC CNI policy
aws_vpc_cni_enable_ipv6	bool	false	Determines whether to enable IPv6 permissions for VPC CNI policy
aws_vpc_cni_policy_name	string	null	Custom name of the VPC CNI IAM policy
cert_manager_hosted_zone_arns	list(string)	[]	Route53 hosted zone ARNs to allow Cert manager to manage records
cert_manager_policy_name	string	null	Custom name of the Cert Manager IAM policy
cluster_autoscaler_cluster_names	list(string)	[]	List of cluster names to appropriately scope permissions within the Cluster Autoscaler IAM policy
cluster_autoscaler_policy_name	string	null	Custom name of the Cluster Autoscaler IAM policy
create	bool	true	Determines whether resources will be created (affects all resources)
custom_policy_description	string	"Custom IAM Policy"	Description of the custom IAM policy
description	string	null	IAM Role description
external_dns_hosted_zone_arns	list(string)	[]	Route53 hosted zone ARNs to allow External DNS to manage records
external_dns_policy_name	string	null	Custom name of the External DNS IAM policy
external_secrets_create_permission	bool	false	Determines whether External Secrets has permission to create/delete secrets
external_secrets_kms_key_arns	list(string)	[]	List of KMS Key ARNs that are used by Secrets Manager that contain secrets to mount using External Secrets
external_secrets_policy_name	string	null	Custom name of the External Secrets IAM policy
external_secrets_secrets_manager_arns	list(string)	[]	List of Secrets Manager ARNs that contain secrets to mount using External Secrets
external_secrets_ssm_parameter_arns	list(string)	[]	List of Systems Manager Parameter ARNs that contain secrets to mount using External Secrets
max_session_duration	number	null	Maximum CLI/API session duration in seconds between 3600 and 43200
mountpoint_s3_csi_bucket_arns	list(string)	[]	List of S3 Bucket ARNs that Mountpoint S3 CSI needs access to list
mountpoint_s3_csi_bucket_path_arns	list(string)	[]	S3 path ARNs to allow Mountpoint S3 CSI driver to manage items at the provided path(s). This is required if `attach_mountpoint_s3_csi_policy = true`
mountpoint_s3_csi_policy_name	string	null	Custom name of the Mountpoint S3 CSI IAM policy
name	string	""	Name of IAM role
override_policy_documents	list(string)	[]	List of IAM policy documents that are merged together into the exported document
path	string	"/"	Path of IAM role
permissions_boundary_arn	string	null	Permissions boundary ARN to use for IAM role
pganalyze_policy_name	string	null	Custom name of the PGAnalyze IAM policy
policy_name_prefix	string	"AmazonEKS_"	IAM policy name prefix
policy_statements	list({...})	null	A list of IAM policy [statements](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document#statement) for custom permission usage
region	string	null	Region where the resource(s) will be managed. Defaults to the Region set in the provider configuration
source_policy_documents	list(string)	[]	List of IAM policy documents that are merged together into the exported document
tags	map(string)	{}	A map of tags to add to all resources
trust_policy_conditions	list({...})	[]	A list of conditions to add to the role trust policy
trust_policy_statements	list({...})	null	A list of IAM policy [statements](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document#statement) for the role trust policy
use_name_prefix	string	true	Determines whether the role name and policy name(s) are used as a prefix
velero_kms_arns	list(string)	[]	KMS key ARNs to allow Velero to manage encrypted s3 buckets
velero_policy_name	string	null	Custom name of the Velero IAM policy
velero_s3_bucket_arns	list(string)	[]	List of S3 Bucket ARNs that Velero needs access to list
velero_s3_bucket_path_arns	list(string)	[]	S3 path ARNs to allow Velero to manage items at the provided path(s). This is required if `attach_mountpoint_s3_csi_policy = true`