mirror of
https://github.com/storytold/terraform-aws-observability-accelerator.git
synced 2026-10-09 00:09:43 +00:00
Venkat Penmetsa
d7daeb8c22
* Added example for multi-cluster eks-monitoring and made changes to eks-monitoring module to allow cross-cluster IRSA * Updated eks-monitoring module's README to add the variable description * Hard-coded grafana license type in eks-cross-cluster-with-amp/main.tf * Added README page for eks-cross-account-with-central-amp * Extracted out the eks/amg creation and modified it to use existing resources * Update README.md to add multiaccount dashboard png * Updated README.md and multiaccount.md to add eks multiaccount png * Updated eks-cross-cluster-with-amp example to disable dashboard creation for cluster 2 * Pre commit changed committed * Fixed cross-account-observability docs and README.md and added variable for amp_workpace_alias * Removed extra spacing in multiaccount.md and added precommit suggested changes * Modified cross-account-observability example to change cross-account-amp-role to snake_case * Capitalized Terraform string in multiaccount.md and converted iam-role-attach to snake_case --------- Co-authored-by: Rodrigue Koffi <bonclay7@users.noreply.github.com>
74 lines
2.2 KiB
Terraform
74 lines
2.2 KiB
Terraform
data "aws_caller_identity" "monitoring" {
|
|
provider = aws.central_monitoring
|
|
}
|
|
|
|
resource "aws_iam_policy" "irsa_assume_role_policy_one" {
|
|
provider = aws.eks_cluster_one
|
|
name = "${var.cluster_one.name}-irsa_assume_role_policy"
|
|
path = "/"
|
|
description = "This role allows the IRSA role to assume the cross-account role for AMP access"
|
|
|
|
policy = jsonencode({
|
|
Version = "2012-10-17"
|
|
Statement = [
|
|
{
|
|
Action = [
|
|
"sts:AssumeRole",
|
|
]
|
|
Effect = "Allow"
|
|
Resource = "arn:aws:iam::${data.aws_caller_identity.monitoring.account_id}:role/${local.amp_workspace_alias}-role-for-cross-account"
|
|
},
|
|
]
|
|
})
|
|
}
|
|
|
|
resource "aws_iam_policy" "irsa_assume_role_policy_two" {
|
|
provider = aws.eks_cluster_two
|
|
name = "${var.cluster_two.name}-irsa_assume_role_policy"
|
|
path = "/"
|
|
description = "This role allows the IRSA role to assume the cross-account role for AMP access"
|
|
|
|
policy = jsonencode({
|
|
Version = "2012-10-17"
|
|
Statement = [
|
|
{
|
|
Action = [
|
|
"sts:AssumeRole",
|
|
]
|
|
Effect = "Allow"
|
|
Resource = "arn:aws:iam::${data.aws_caller_identity.monitoring.account_id}:role/${local.amp_workspace_alias}-role-for-cross-account"
|
|
},
|
|
]
|
|
})
|
|
}
|
|
|
|
resource "aws_iam_role" "cross_account_amp_role" {
|
|
provider = aws.central_monitoring
|
|
name = "${local.amp_workspace_alias}-role-for-cross-account"
|
|
|
|
assume_role_policy = <<EOF
|
|
{
|
|
"Version": "2012-10-17",
|
|
"Statement": [
|
|
{
|
|
"Effect": "Allow",
|
|
"Principal": {
|
|
"AWS": [
|
|
"${module.eks_monitoring_one.adot_irsa_arn}",
|
|
"${module.eks_monitoring_two.adot_irsa_arn}"
|
|
]
|
|
},
|
|
"Action": "sts:AssumeRole",
|
|
"Condition": {}
|
|
}
|
|
]
|
|
}
|
|
EOF
|
|
}
|
|
|
|
resource "aws_iam_role_policy_attachment" "role_attach" {
|
|
provider = aws.central_monitoring
|
|
role = aws_iam_role.cross_account_amp_role.name
|
|
policy_arn = "arn:aws:iam::aws:policy/AmazonPrometheusRemoteWriteAccess"
|
|
}
|