From e93d20783dccdc040794b0894a75a82787b142ac Mon Sep 17 00:00:00 2001 From: Christopher Haar Date: Tue, 21 Sep 2021 14:33:35 +0200 Subject: [PATCH] fix(cw-loggroup): added deny in eks cluster role to fix cw-loggroup recreate in cleanup/deletion Signed-off-by: Christopher Haar --- README.md | 15 +++++++++------ main.tf | 35 +++++++++++++++++++++++++++++++++++ 2 files changed, 44 insertions(+), 6 deletions(-) diff --git a/README.md b/README.md index 5562a605f17..2a2b58f6f7b 100644 --- a/README.md +++ b/README.md @@ -134,17 +134,17 @@ Apache 2 Licensed. See [LICENSE](https://github.com/terraform-aws-modules/terraf | Name | Version | |------|---------| -| [aws](#provider\_aws) | >= 3.56.0 | -| [http](#provider\_http) | >= 2.4.1 | -| [kubernetes](#provider\_kubernetes) | >= 1.11.1 | -| [local](#provider\_local) | >= 1.4 | +| [aws](#provider\_aws) | 3.59.0 | +| [http](#provider\_http) | 2.4.1 | +| [kubernetes](#provider\_kubernetes) | 2.5.0 | +| [local](#provider\_local) | 2.1.0 | ## Modules | Name | Source | Version | |------|--------|---------| -| [fargate](#module\_fargate) | ./modules/fargate | | -| [node\_groups](#module\_node\_groups) | ./modules/node_groups | | +| [fargate](#module\_fargate) | ./modules/fargate | n/a | +| [node\_groups](#module\_node\_groups) | ./modules/node_groups | n/a | ## Resources @@ -157,12 +157,14 @@ Apache 2 Licensed. See [LICENSE](https://github.com/terraform-aws-modules/terraf | [aws_iam_instance_profile.workers](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_instance_profile) | resource | | [aws_iam_instance_profile.workers_launch_template](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_instance_profile) | resource | | [aws_iam_openid_connect_provider.oidc_provider](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_openid_connect_provider) | resource | +| [aws_iam_policy.cluster_deny_log_group](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource | | [aws_iam_policy.cluster_elb_sl_role_creation](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource | | [aws_iam_role.cluster](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource | | [aws_iam_role.workers](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource | | [aws_iam_role_policy_attachment.cluster_AmazonEKSClusterPolicy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource | | [aws_iam_role_policy_attachment.cluster_AmazonEKSServicePolicy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource | | [aws_iam_role_policy_attachment.cluster_AmazonEKSVPCResourceControllerPolicy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource | +| [aws_iam_role_policy_attachment.cluster_deny_log_group](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource | | [aws_iam_role_policy_attachment.cluster_elb_sl_role_creation](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource | | [aws_iam_role_policy_attachment.workers_AmazonEC2ContainerRegistryReadOnly](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource | | [aws_iam_role_policy_attachment.workers_AmazonEKSWorkerNodePolicy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource | @@ -191,6 +193,7 @@ Apache 2 Licensed. See [LICENSE](https://github.com/terraform-aws-modules/terraf | [aws_iam_instance_profile.custom_worker_group_iam_instance_profile](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_instance_profile) | data source | | [aws_iam_instance_profile.custom_worker_group_launch_template_iam_instance_profile](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_instance_profile) | data source | | [aws_iam_policy_document.cluster_assume_role_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source | +| [aws_iam_policy_document.cluster_deny_log_group](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source | | [aws_iam_policy_document.cluster_elb_sl_role_creation](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source | | [aws_iam_policy_document.workers_assume_role_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source | | [aws_iam_role.custom_cluster_iam_role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_role) | data source | diff --git a/main.tf b/main.tf index 328f279dc76..d1860f06964 100644 --- a/main.tf +++ b/main.tf @@ -195,3 +195,38 @@ resource "aws_iam_role_policy_attachment" "cluster_elb_sl_role_creation" { policy_arn = aws_iam_policy.cluster_elb_sl_role_creation[0].arn role = local.cluster_iam_role_name } + +/* + Adding a policy to cluster IAM role that deny permissions to logs:CreateLogGroup + it is not needed since we create the log group ourselve in this module, and it is causing trouble during cleanup/deletion +*/ + +data "aws_iam_policy_document" "cluster_deny_log_group" { + count = var.manage_cluster_iam_resources && var.create_eks ? 1 : 0 + + statement { + effect = "Deny" + actions = [ + "logs:CreateLogGroup" + ] + resources = ["*"] + } +} + +resource "aws_iam_policy" "cluster_deny_log_group" { + count = var.manage_cluster_iam_resources && var.create_eks ? 1 : 0 + + name_prefix = "${var.cluster_name}-deny-log-group" + description = "Deny CreateLogGroup" + policy = data.aws_iam_policy_document.cluster_deny_log_group[0].json + path = var.iam_path + + tags = var.tags +} + +resource "aws_iam_role_policy_attachment" "cluster_deny_log_group" { + count = var.manage_cluster_iam_resources && var.create_eks ? 1 : 0 + + policy_arn = aws_iam_policy.cluster_deny_log_group[0].arn + role = local.cluster_iam_role_name +}