"arn:aws:iam::${data.aws_caller_identity.current.account_id}:role/aws-service-role/autoscaling.amazonaws.com/AWSServiceRoleForAutoScaling",# required for the ASG to manage encrypted volumes for nodes
module.eks.cluster_iam_role_arn,# required for the cluster / persistentvolume-controller to create encrypted PVCs
]
}
actions=[
"kms:Encrypt",
"kms:Decrypt",
"kms:ReEncrypt*",
"kms:GenerateDataKey*",
"kms:DescribeKey"
]
resources=["*"]
}
statement{
sid="Allow attachment of persistent resources"
effect="Allow"
principals{
type="AWS"
identifiers=[
"arn:aws:iam::${data.aws_caller_identity.current.account_id}:role/aws-service-role/autoscaling.amazonaws.com/AWSServiceRoleForAutoScaling",# required for the ASG to manage encrypted volumes for nodes
module.eks.cluster_iam_role_arn,# required for the cluster / persistentvolume-controller to create encrypted PVCs
# If you use a custom AMI, you need to supply via user-data, the bootstrap script as EKS DOESNT merge its managed user-data then
# you can add more than the minimum code you see in the template, e.g. install SSM agent, see https://github.com/aws/containers-roadmap/issues/593#issuecomment-577181345
#
# (optionally you can use https://registry.terraform.io/providers/hashicorp/cloudinit/latest/docs/data-sources/cloudinit_config to render the script, example: https://github.com/terraform-aws-modules/terraform-aws-eks/pull/997#issuecomment-705286151)
# Supplying custom tags to EKS instances is another use-case for LaunchTemplates
tag_specifications{
resource_type="instance"
tags={
CustomTag="EKS example"
}
}
# Supplying custom tags to EKS instances root volumes is another use-case for LaunchTemplates. (doesnt add tags to dynamically provisioned volumes via PVC tho)
