14-team-dojangkok-cloud/IaC/3-v3/aws/modules/iam/main.tf at 06f7e97000f4268e868a025f7abc5ac19d8f6608 · 100-hours-a-week/14-team-dojangkok-cloud · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
# ============================================================
# V3 K8S IaC — IAM (K8S 노드 역할 + ECR/EBS/SSM 정책)
# Branch: feat/v3-k8s-iac
# ============================================================

# --- K8S Node Role ---

resource "aws_iam_role" "k8s_node" {
  name = "${var.project_name}-k8s-node-role"

  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Action = "sts:AssumeRole"
      Effect = "Allow"
      Principal = {
        Service = "ec2.amazonaws.com"
      }
    }]
  })

  tags = var.common_tags
}

# --- Instance Profile ---

resource "aws_iam_instance_profile" "k8s_node" {
  name = "${var.project_name}-k8s-node-profile"
  role = aws_iam_role.k8s_node.name
}

# --- ECR Pull Policy ---

resource "aws_iam_role_policy" "ecr_pull" {
  name = "ecr-pull"
  role = aws_iam_role.k8s_node.id

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect = "Allow"
      Action = [
        "ecr:GetDownloadUrlForLayer",
        "ecr:BatchGetImage",
        "ecr:BatchCheckLayerAvailability",
        "ecr:GetAuthorizationToken"
      ]
      Resource = "*"
    }]
  })
}

# --- EBS CSI Driver Policy ---

resource "aws_iam_role_policy" "ebs_csi" {
  name = "ebs-csi"
  role = aws_iam_role.k8s_node.id

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect = "Allow"
      Action = [
        "ec2:CreateVolume",
        "ec2:DeleteVolume",
        "ec2:AttachVolume",
        "ec2:DetachVolume",
        "ec2:DescribeVolumes",
        "ec2:DescribeInstances",
        "ec2:DescribeAvailabilityZones",
        "ec2:ModifyVolume",
        "ec2:DescribeVolumesModifications",
        "ec2:CreateTags"
      ]
      Resource = "*"
    }]
  })
}

# --- SSM Session Manager Policy ---

resource "aws_iam_role_policy_attachment" "ssm" {
  role       = aws_iam_role.k8s_node.name
  policy_arn = "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore"
}

# --- Secrets Manager Read Policy (ESO) ---

resource "aws_iam_role_policy" "secrets_manager" {
  name = "secrets-manager-read"
  role = aws_iam_role.k8s_node.id

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect = "Allow"
      Action = [
        "secretsmanager:GetSecretValue",
        "secretsmanager:DescribeSecret"
      ]
      Resource = "arn:aws:secretsmanager:${var.aws_region}:${var.aws_account_id}:secret:dojangkok/*"
    }]
  })
}

# --- S3 for Ansible SSM file transfer ---

resource "aws_iam_role_policy" "ssm_s3" {
  name = "ssm-s3-transfer"
  role = aws_iam_role.k8s_node.id

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect = "Allow"
      Action = [
        "s3:GetObject",
        "s3:PutObject",
        "s3:DeleteObject",
        "s3:GetBucketLocation",
        "s3:ListBucket"
      ]
      Resource = [
        "arn:aws:s3:::dojangkok-v3-ansible-ssm",
        "arn:aws:s3:::dojangkok-v3-ansible-ssm/*"
      ]
    }]
  })
}