move IRSA roles from base AWS provisioning

Author: eddiewebb

core-env/aws/main.tf

@@ -105,45 +105,3 @@ resource "aws_iam_role_policy_attachment" "gha_attachment" {
 
 
 
-#
-# Secrets Manager for ESO
-#
-
-resource "aws_iam_policy" "demo_secrets_policy" {
-  name        = "sedemo-secrets-access-from-eks"
-  description = "Policy to grant demo cluster access to secrets via ESO"
-
-  policy = templatefile(
-    "${path.module}/templates/secrets_policy.json.tpl",
-    {
-      AWS_ACCOUNT_ID = data.aws_caller_identity.current.id
-    }
-  )
-
-  tags = var.common_tags
-  lifecycle {
-    create_before_destroy = true
-  }
-}
-
-resource "aws_iam_role" "secrets_role" {
-  name        = "sedemo-secrets-access-from-eks"
-  description = "Role grants access to secrets policy for ESO"
-
-  assume_role_policy = templatefile(
-    "${path.module}/templates/secrets_role.json.tpl",
-    {
-
-    }
-  )
-
-  tags = var.common_tags
-  lifecycle {
-    create_before_destroy = true
-  }
-}
-
-resource "aws_iam_role_policy_attachment" "secrets_attachment" {
-  role       = aws_iam_role.secrets_role.name
-  policy_arn = aws_iam_policy.demo_secrets_policy.arn
-}

core-env/aws/templates/secrets_policy.json.tpl

@@ -205,3 +205,14 @@ resource "aws_route53_record" "records" {
   records    = [data.kubernetes_service_v1.nginx_ingress.status.0.load_balancer.0.ingress.0.hostname]
   depends_on = [helm_release.nginx_ingress]
 }
+
+
+#
+#
+#. TODO: use `output "secrets_policy_name"` to attach to the OIDC role created by irsa=true above.
+#
+
+   resource "aws_iam_role_policy_attachment" "s3_read_only" {
+      role       = eks.module.oidc_provider_arn
+      policy_arn = data.terraform_remote_state.arad_aws_state.outputs.secrets_policy_arn
+    }