Add IRSA to airflow dev environment

terraform/aws/analytical-platform-data-production/airflow/iam-policies.tf

@@ -261,6 +261,32 @@ data "aws_iam_policy_document" "airflow_dev_eks_assume_role_policy" {
 
 }
 
+##### Airflow Dev IRSA
+data "aws_iam_policy_document" "airflow_dev_monitoring_inline_role_policy" {
+  statement {
+    sid    = ""
+    effect = "Allow"
+    resources = [
+      "arn:aws:iam::${var.account_ids["analytical-platform-data-production"]}:airflow-monitoring/airflow-scheduling-testing/*",
+      "arn:aws:iam::${var.account_ids["analytical-platform-data-production"]}:airflow-monitoring/"
+    ]
+    actions = ["s3:GetObject", "s3:ListBucket", "s3:PutObject", "s3:DeleteObject"]
+  }
+
+}
+
+module "airflow_dev_monitoring_iam_policy" {
+  #checkov:skip=CKV_TF_1:Module registry does not support commit hashes for versions
+
+  source  = "terraform-aws-modules/iam/aws//modules/iam-policy"
+  version = "5.39.1"
+
+  name = "airflow_dev_monitoring"
+
+  policy = data.aws_iam_policy_document.airflow_dev_monitoring_inline_role_policy.json
+}
+
+
 ############################ AIRFLOW PRODUCTION INFRASTRUCTURE
 
 data "aws_iam_policy_document" "airflow_prod_execution_assume_role_policy" {

terraform/aws/analytical-platform-data-production/airflow/iam-roles.tf

@@ -86,6 +86,29 @@ resource "aws_iam_role" "airflow_dev_eks_role" {
   ]
 }
 
+#### Airflow Dev IRSA
+module "airflow_dev_monitoring_iam_role" {
+  #checkov:skip=CKV_TF_1:Module registry does not support commit hashes for versions
+
+  source  = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts-eks"
+  version = "5.39.1"
+
+  create_role = true
+
+  role_name = "airflow-monitoring-dev"
+
+  role_policy_arns = {
+    policy = module.airflow_dev_monitoring_iam_policy.arn
+  }
+
+  oidc_providers = {
+    one = {
+      provider_arn               = resource.aws_iam_openid_connect_provider.analytical_platform_development.arn
+      namespace_service_accounts = ["airflow:airflow"]
+    }
+  }
+}
+
 ####################################################################################
 ######################### AIRFLOW PRODUCTION INFRASTRUCTURE ########################
 ####################################################################################

terraform/aws/analytical-platform-data-production/airflow/kubernetes-service-accounts.tf

@@ -0,0 +1,9 @@
+resource "kubernetes_service_account" "airflow" {
+  metadata {
+    namespace = kubernetes_namespace.dev_airflow.metadata[0].name
+    name      = "airflow"
+    annotations = {
+      "eks.amazonaws.com/role-arn" = "arn:aws:iam::593291632749:role/airflow_monitoring_dev"
+    }
+  }
+}