additional permissions for eks cluster

[michaeldeggers]

No description provided.

[github-actions]

Terraform Format and Style 🖌success

Terraform Initialization ⚙️success

Terraform Validation 🤖success

Terraform Plan 📖success

Show Plan

terraform
Running plan in the remote backend. Output will stream here. Pressing Ctrl-C
will stop streaming the logs, but will not stop the plan running remotely.

Preparing the remote plan...

To view this run in a browser, visit:
https://app.terraform.io/app/eggs-projects/infra/runs/run-ypVmFbZNWF6kKWgG

Waiting for the plan to start...

Terraform v1.1.8
on linux_amd64
Initializing plugins and modules...
github_repository.projects["test-repo"]: Refreshing state... [id=test-repo]
github_repository.projects["eks-cluster"]: Refreshing state... [id=eks-cluster]
module.tfe_dev.tfe_workspace.projects["test-repo"]: Refreshing state... [id=ws-SfnrJgVt5Pa4qND4]
github_repository.projects["ghost-blog"]: Refreshing state... [id=ghost-blog]
module.tfe_prod.tfe_workspace.projects["eks-cluster"]: Refreshing state... [id=ws-2UM6wJu7cQvpUL5J]
module.tfe_dev.tfe_workspace.projects["eks-cluster"]: Refreshing state... [id=ws-nM2qNNjkvdjUjWDD]
module.tfe_dev.tfe_workspace.projects["ghost-blog"]: Refreshing state... [id=ws-PYgtf5qUjmec5gC1]
module.tfe_prod.tfe_workspace.projects["ghost-blog"]: Refreshing state... [id=ws-L1LBC3UZSEpVPgEX]
module.tfe_dev.tfe_variable.aws_account_id["eks-cluster"]: Refreshing state... [id=var-hexdHXNAzww8hoW6]
module.tfe_dev.tfe_variable.route53_hosted_zone_name["ghost-blog"]: Refreshing state... [id=var-74wqJmApSP355PtE]
module.tfe_dev.tfe_variable.aws_account_id["ghost-blog"]: Refreshing state... [id=var-EXXLQJDkhTjrPinc]
module.tfe_dev.tfe_variable.aws_account_id["test-repo"]: Refreshing state... [id=var-KkpSpXMqfuymYhhZ]
module.tfe_dev.tfe_variable.route53_hosted_zone_name["test-repo"]: Refreshing state... [id=var-QocBoKWYgndBj8UC]
module.tfe_dev.tfe_variable.route53_hosted_zone_name["eks-cluster"]: Refreshing state... [id=var-5eqFhFcTJ5rEF6u1]
module.tfe_dev.tfe_variable.organization["ghost-blog"]: Refreshing state... [id=var-VtNpGj8Uznax9iT7]
module.tfe_dev.tfe_variable.organization["test-repo"]: Refreshing state... [id=var-rL5FG1o3nyvDcw3a]
module.tfe_dev.tfe_variable.organization["eks-cluster"]: Refreshing state... [id=var-GHdA8aSJYFpBEdGE]
module.tfe_dev.tfe_variable.project_name["eks-cluster"]: Refreshing state... [id=var-4SzyqxSDxHbuH3fy]
module.tfe_dev.tfe_variable.project_name["ghost-blog"]: Refreshing state... [id=var-wjmUtCLRhNCGCg9T]
module.tfe_dev.tfe_variable.project_name["test-repo"]: Refreshing state... [id=var-VjfYSMYJZ1TRUeip]
module.aws_prod.aws_iam_policy.route53_record_updates: Refreshing state... [id=arn:aws:iam::174199678932:policy/eggs-projects-deploy-route53-policy]
module.aws_prod.aws_iam_user.projects["eks-cluster"]: Refreshing state... [id=eggs-projects-eks-cluster-user]
module.aws_prod.aws_iam_user.projects["ghost-blog"]: Refreshing state... [id=eggs-projects-ghost-blog-user]
module.aws_prod.aws_iam_role.admin_role: Refreshing state... [id=eggs-projects-admin-role]
module.tfe_prod.tfe_variable.route53_hosted_zone_name["eks-cluster"]: Refreshing state... [id=var-9tVpSCbDJz4V65ab]
module.tfe_prod.tfe_variable.route53_hosted_zone_name["ghost-blog"]: Refreshing state... [id=var-41JsaZjphGtmPrem]
module.tfe_prod.tfe_variable.project_name["eks-cluster"]: Refreshing state... [id=var-RvUAYfZbLBk6JFfD]
module.tfe_prod.tfe_variable.project_name["ghost-blog"]: Refreshing state... [id=var-oZyN63DNurs5WPLQ]
module.tfe_prod.tfe_variable.aws_account_id["eks-cluster"]: Refreshing state... [id=var-xvss7bFhch7Fwts9]
module.tfe_prod.tfe_variable.aws_account_id["ghost-blog"]: Refreshing state... [id=var-93W25tcmfs3Ns2Du]
module.tfe_prod.tfe_variable.organization["ghost-blog"]: Refreshing state... [id=var-xrNqsqt3n2n7PCvi]
module.tfe_prod.tfe_variable.organization["eks-cluster"]: Refreshing state... [id=var-AsQri71ytBKkPAuT]
module.aws_prod.aws_iam_access_key.projects["eks-cluster"]: Refreshing state... [id=AKIASRDY4E7KDGPNWBFF]
module.aws_prod.aws_iam_access_key.projects["ghost-blog"]: Refreshing state... [id=AKIASRDY4E7KPUBNHI73]
module.aws_dev.aws_iam_role.admin_role: Refreshing state... [id=eggs-projects-admin-role]
module.aws_dev.aws_iam_user.admin[0]: Refreshing state... [id=eggs-projects-admin]
module.aws_dev.aws_iam_policy.route53_record_updates: Refreshing state... [id=arn:aws:iam::470292911211:policy/eggs-projects-deploy-route53-policy]
module.aws_dev.aws_iam_user.projects["eks-cluster"]: Refreshing state... [id=eggs-projects-eks-cluster-user]
module.aws_dev.aws_iam_user.projects["ghost-blog"]: Refreshing state... [id=eggs-projects-ghost-blog-user]
module.aws_dev.aws_iam_user.projects["test-repo"]: Refreshing state... [id=eggs-projects-test-repo-user]
github_actions_secret.tf_api_token["eks-cluster"]: Refreshing state... [id=eks-cluster:TF_API_TOKEN]
github_actions_secret.tf_api_token["ghost-blog"]: Refreshing state... [id=ghost-blog:TF_API_TOKEN]
github_actions_secret.tf_api_token["test-repo"]: Refreshing state... [id=test-repo:TF_API_TOKEN]
github_repository_environment.prod["eks-cluster"]: Refreshing state... [id=eks-cluster:prod]
github_repository_environment.prod["ghost-blog"]: Refreshing state... [id=ghost-blog:prod]
github_repository_environment.dev["eks-cluster"]: Refreshing state... [id=eks-cluster:dev]
github_repository_environment.dev["ghost-blog"]: Refreshing state... [id=ghost-blog:dev]
module.aws_prod.aws_iam_role.deploy: Refreshing state... [id=eggs-projects-deploy-role]
module.aws_dev.aws_iam_user_policy.admin_dev[0]: Refreshing state... [id=eggs-projects-admin:eggs-projects-admin-assume-role-policy]
module.aws_dev.aws_iam_user_policy.admin[0]: Refreshing state... [id=eggs-projects-admin:eggs-projects-admin-assume-role-policy]
module.aws_dev.aws_iam_access_key.projects["eks-cluster"]: Refreshing state... [id=AKIAW275EKRVZCNL74AV]
module.aws_dev.aws_iam_access_key.projects["test-repo"]: Refreshing state... [id=AKIAW275EKRVZ3MHLWVG]
module.aws_dev.aws_iam_access_key.projects["ghost-blog"]: Refreshing state... [id=AKIAW275EKRVY4W47SUK]
module.tfe_prod.tfe_variable.secret_key["eks-cluster"]: Refreshing state... [id=var-o4JqH46Sa4uqCdVn]
module.tfe_prod.tfe_variable.secret_key["ghost-blog"]: Refreshing state... [id=var-7SdEEzBG6XSrG4ym]
module.tfe_prod.tfe_variable.access_key["ghost-blog"]: Refreshing state... [id=var-Pr4pju9ToTAB6Pov]
module.tfe_prod.tfe_variable.access_key["eks-cluster"]: Refreshing state... [id=var-bys135sX1BH7PEHc]
module.aws_dev.aws_iam_role.deploy: Refreshing state... [id=eggs-projects-deploy-role]
module.aws_prod.aws_iam_role_policy_attachment.AmazonEC2FullAccess: Refreshing state... [id=eggs-projects-deploy-role-20221126031544389000000002]
module.aws_prod.aws_iam_role_policy_attachment.route53_record_updates: Refreshing state... [id=eggs-projects-deploy-role-20221126031544382100000001]
module.aws_prod.aws_iam_user_policy.projects["ghost-blog"]: Refreshing state... [id=eggs-projects-ghost-blog-user:eggs-projects-ghost-blog-assume-role-policy]
module.aws_prod.aws_iam_user_policy.projects["eks-cluster"]: Refreshing state... [id=eggs-projects-eks-cluster-user:eggs-projects-eks-cluster-assume-role-policy]
module.tfe_dev.tfe_variable.secret_key["eks-cluster"]: Refreshing state... [id=var-JWfZuFgqAwPm2vi7]
module.tfe_dev.tfe_variable.secret_key["test-repo"]: Refreshing state... [id=var-nfehnNRmmscGF9Ki]
module.tfe_dev.tfe_variable.secret_key["ghost-blog"]: Refreshing state... [id=var-VwUvW23HYCN64iWj]
module.tfe_dev.tfe_variable.access_key["eks-cluster"]: Refreshing state... [id=var-FRx63KT2qDox2HPx]
module.tfe_dev.tfe_variable.access_key["ghost-blog"]: Refreshing state... [id=var-y9b3DuqXBA3u8QeU]
module.tfe_dev.tfe_variable.access_key["test-repo"]: Refreshing state... [id=var-sJ9VXSjcxCKzXZnx]
module.aws_dev.aws_iam_role_policy_attachment.route53_record_updates: Refreshing state... [id=eggs-projects-deploy-role-20221124021210474500000001]
module.aws_dev.aws_iam_user_policy.projects["test-repo"]: Refreshing state... [id=eggs-projects-test-repo-user:eggs-projects-test-repo-assume-role-policy]
module.aws_dev.aws_iam_user_policy.projects["eks-cluster"]: Refreshing state... [id=eggs-projects-eks-cluster-user:eggs-projects-eks-cluster-assume-role-policy]
module.aws_dev.aws_iam_user_policy.projects["ghost-blog"]: Refreshing state... [id=eggs-projects-ghost-blog-user:eggs-projects-ghost-blog-assume-role-policy]
module.aws_dev.aws_iam_role_policy_attachment.AmazonEC2FullAccess: Refreshing state... [id=eggs-projects-deploy-role-20221123030841241800000001]
module.aws_dev.aws_iam_user_policy.eggs_cli[0]: Refreshing state... [id=eggs-cli:eggs-cli-deploy-assume-role-policy]

Note: Objects have changed outside of Terraform

Terraform detected the following changes made outside of Terraform since the
last "terraform apply":

  # github_repository.projects["eks-cluster"] has changed
  ~ resource "github_repository" "projects" {
      ~ etag                        = "W/\"a62d54b198e52465bf31a2917e46525d1746b535c2bddf96f7b225b7a68b9581\"" -> "W/\"a66857bfda820aa3b584d5b8f6d635dd161ccffbf15ebc9c673a76ad9f8dbb36\""
        id                          = "eks-cluster"
        name                        = "eks-cluster"
        # (32 unchanged attributes hidden)


        # (2 unchanged blocks hidden)
    }

  # module.aws_dev.aws_iam_user_policy.admin_dev[0] has changed
  ~ resource "aws_iam_user_policy" "admin_dev" {
        id     = "eggs-projects-admin:eggs-projects-admin-assume-role-policy"
        name   = "eggs-projects-admin-assume-role-policy"
      ~ policy = jsonencode(
          ~ {
              ~ Statement = [
                  ~ {
                      ~ Resource = "arn:aws:iam::470292911211:role/eggs-projects-admin-role" -> [
                          + "arn:aws:iam::174199678932:role/eggs-projects-admin-role",
                          + "arn:aws:iam::470292911211:role/eggs-projects-admin-role",
                        ]
                        # (2 unchanged elements hidden)
                    },
                ]
                # (1 unchanged element hidden)
            }
        )
        # (1 unchanged attribute hidden)
    }


Unless you have made equivalent changes to your configuration, or ignored the
relevant attributes using ignore_changes, the following plan may include
actions to undo or respond to these changes.

─────────────────────────────────────────────────────────────────────────────

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  ~ update in-place

Terraform will perform the following actions:

  # module.aws_dev.aws_iam_role.deploy will be updated in-place
  ~ resource "aws_iam_role" "deploy" {
        id                    = "eggs-projects-deploy-role"
        name                  = "eggs-projects-deploy-role"
        tags                  = {}
        # (9 unchanged attributes hidden)

      + inline_policy {
          + name   = "eggs-projects-deploy-policy"
          + policy = jsonencode(
                {
                  + Statement = [
                      + {
                          + Action    = [
                              + "*",
                            ]
                          + Condition = {
                              + StringEquals = {
                                  + "aws:ResourceTag/owner" = "eggs-projects-*"
                                }
                            }
                          + Effect    = "Allow"
                          + Resource  = "*"
                        },
                      + {
                          + Action   = [
                              + "iam:*",
                            ]
                          + Effect   = "Allow"
                          + Resource = [
                              + "arn:aws:iam::470292911211:role/eggs-projects-*",
                              + "arn:aws:iam::470292911211:instance-profile/eggs-projects-*",
                              + "arn:aws:iam::470292911211:role/karpenter-*",
                              + "arn:aws:iam::470292911211:role/kube-system-*",
                            ]
                        },
                      + {
                          + Action   = [
                              + "ecr-public:GetAuthorizationToken",
                              + "sts:GetServiceBearerToken",
                            ]
                          + Effect   = "Allow"
                          + Resource = "*"
                        },
                      + {
                          + Action   = [
                              + "logs:*",
                            ]
                          + Effect   = "Allow"
                          + Resource = [
                              + "arn:aws:logs:us-east-1:470292911211:log-group:/aws/eks/eggs-projects-*",
                            ]
                        },
                      + {
                          + Action   = [
                              + "kms:TagResource",
                            ]
                          + Effect   = "Allow"
                          + Resource = "*"
                        },
                    ]
                  + Version   = "2012-10-17"
                }
            )
        }
      - inline_policy {
          - name   = "eggs-projects-deploy-policy" -> null
          - policy = jsonencode(
                {
                  - Statement = [
                      - {
                          - Action    = [
                              - "*",
                            ]
                          - Condition = {
                              - StringEquals = {
                                  - "aws:ResourceTag/owner" = "eggs-projects-*"
                                }
                            }
                          - Effect    = "Allow"
                          - Resource  = "*"
                        },
                      - {
                          - Action   = [
                              - "iam:*",
                            ]
                          - Effect   = "Allow"
                          - Resource = [
                              - "arn:aws:iam::470292911211:role/eggs-projects-*",
                              - "arn:aws:iam::470292911211:instance-profile/eggs-projects-*",
                            ]
                        },
                      - {
                          - Action   = [
                              - "ecr-public:GetAuthorizationToken",
                              - "sts:GetServiceBearerToken",
                            ]
                          - Effect   = "Allow"
                          - Resource = "*"
                        },
                    ]
                  - Version   = "2012-10-17"
                }
            ) -> null
        }
        # (1 unchanged block hidden)
    }

  # module.aws_dev.aws_iam_user_policy.admin_dev[0] will be updated in-place
  ~ resource "aws_iam_user_policy" "admin_dev" {
        id     = "eggs-projects-admin:eggs-projects-admin-assume-role-policy"
        name   = "eggs-projects-admin-assume-role-policy"
      ~ policy = jsonencode(
          ~ {
              ~ Statement = [
                  ~ {
                      ~ Resource = [
                          - "arn:aws:iam::174199678932:role/eggs-projects-admin-role",
                          - "arn:aws:iam::470292911211:role/eggs-projects-admin-role",
                        ] -> "arn:aws:iam::470292911211:role/eggs-projects-admin-role"
                        # (2 unchanged elements hidden)
                    },
                ]
                # (1 unchanged element hidden)
            }
        )
        # (1 unchanged attribute hidden)
    }

  # module.aws_prod.aws_iam_role.deploy will be updated in-place
  ~ resource "aws_iam_role" "deploy" {
        id                    = "eggs-projects-deploy-role"
        name                  = "eggs-projects-deploy-role"
        tags                  = {}
        # (9 unchanged attributes hidden)

      + inline_policy {
          + name   = "eggs-projects-deploy-policy"
          + policy = jsonencode(
                {
                  + Statement = [
                      + {
                          + Action    = [
                              + "*",
                            ]
                          + Condition = {
                              + StringEquals = {
                                  + "aws:ResourceTag/owner" = "eggs-projects-*"
                                }
                            }
                          + Effect    = "Allow"
                          + Resource  = "*"
                        },
                      + {
                          + Action   = [
                              + "iam:*",
                            ]
                          + Effect   = "Allow"
                          + Resource = [
                              + "arn:aws:iam::174199678932:role/eggs-projects-*",
                              + "arn:aws:iam::174199678932:instance-profile/eggs-projects-*",
                              + "arn:aws:iam::174199678932:role/karpenter-*",
                              + "arn:aws:iam::174199678932:role/kube-system-*",
                            ]
                        },
                      + {
                          + Action   = [
                              + "ecr-public:GetAuthorizationToken",
                              + "sts:GetServiceBearerToken",
                            ]
                          + Effect   = "Allow"
                          + Resource = "*"
                        },
                      + {
                          + Action   = [
                              + "logs:*",
                            ]
                          + Effect   = "Allow"
                          + Resource = [
                              + "arn:aws:logs:us-east-1:174199678932:log-group:/aws/eks/eggs-projects-*",
                            ]
                        },
                      + {
                          + Action   = [
                              + "kms:TagResource",
                            ]
                          + Effect   = "Allow"
                          + Resource = "*"
                        },
                    ]
                  + Version   = "2012-10-17"
                }
            )
        }
      - inline_policy {
          - name   = "eggs-projects-deploy-policy" -> null
          - policy = jsonencode(
                {
                  - Statement = [
                      - {
                          - Action    = [
                              - "*",
                            ]
                          - Condition = {
                              - StringEquals = {
                                  - "aws:ResourceTag/owner" = "eggs-projects-*"
                                }
                            }
                          - Effect    = "Allow"
                          - Resource  = "*"
                        },
                      - {
                          - Action   = [
                              - "iam:*",
                            ]
                          - Effect   = "Allow"
                          - Resource = [
                              - "arn:aws:iam::174199678932:role/eggs-projects-*",
                              - "arn:aws:iam::174199678932:instance-profile/eggs-projects-*",
                            ]
                        },
                      - {
                          - Action   = [
                              - "ecr-public:GetAuthorizationToken",
                              - "sts:GetServiceBearerToken",
                            ]
                          - Effect   = "Allow"
                          - Resource = "*"
                        },
                    ]
                  - Version   = "2012-10-17"
                }
            ) -> null
        }
        # (1 unchanged block hidden)
    }

Plan: 0 to add, 3 to change, 0 to destroy.


------------------------------------------------------------------------

Cost estimation:

Resources: 0 of 15 estimated
           $0.0/mo +$0.0

Pushed by: @michaeldeggers, Action: pull_request