fix: SSM 연결을 위한 누락 설정 추가

- K8S 노드에 SSM Agent 설치 user_data 추가 (Ubuntu 24.04 미포함)
- K8S 노드 IAM Role에 S3 버킷 권한 추가 (aws_ssm 파일 전송용)

Author: WAFriend3416

IaC/3-v3/aws/modules/iam/main.tf

@@ -83,3 +83,27 @@ resource "aws_iam_role_policy_attachment" "ssm" {
   role       = aws_iam_role.k8s_node.name
   policy_arn = "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore"
 }
+
+# --- S3 for Ansible SSM file transfer ---
+
+resource "aws_iam_role_policy" "ssm_s3" {
+  name = "ssm-s3-transfer"
+  role = aws_iam_role.k8s_node.id
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [{
+      Effect = "Allow"
+      Action = [
+        "s3:GetObject",
+        "s3:PutObject",
+        "s3:DeleteObject",
+        "s3:GetBucketLocation"
+      ]
+      Resource = [
+        "arn:aws:s3:::dojangkok-v3-ansible-ssm",
+        "arn:aws:s3:::dojangkok-v3-ansible-ssm/*"
+      ]
+    }]
+  })
+}

IaC/3-v3/aws/modules/k8s-nodes/main.tf

@@ -35,6 +35,7 @@ resource "aws_instance" "control_plane" {
   vpc_security_group_ids = var.cp_security_group_ids
   iam_instance_profile   = var.iam_instance_profile
   source_dest_check      = false
+  user_data              = local.ssm_user_data
 
   metadata_options {
     http_endpoint               = "enabled"
@@ -63,6 +64,13 @@ resource "aws_instance" "control_plane" {
 # --- Worker Nodes ---
 
 locals {
+  ssm_user_data = <<-EOF
+    #!/bin/bash
+    snap install amazon-ssm-agent --classic
+    systemctl enable snap.amazon-ssm-agent.amazon-ssm-agent.service
+    systemctl start snap.amazon-ssm-agent.amazon-ssm-agent.service
+  EOF
+
   # workers_per_az × 3 AZ → 플랫 맵 생성
   # e.g. workers_per_az=1 → { "w-2a-1"={az="a",...}, "w-2b-1"={...}, "w-2c-1"={...} }
   # e.g. workers_per_az=2 → { "w-2a-1"={...}, "w-2a-2"={...}, "w-2b-1"={...}, ... }
@@ -87,6 +95,7 @@ resource "aws_instance" "workers" {
   vpc_security_group_ids = var.worker_security_group_ids
   iam_instance_profile   = var.iam_instance_profile
   source_dest_check      = false
+  user_data              = local.ssm_user_data
 
   metadata_options {
     http_endpoint               = "enabled"