Skip to content

Commit 76ab5ec

Browse files
committed
feat: Add CloudWatch Exporter IRSA role support
Add optional IRSA role for prometheus-cloudwatch-exporter to enable scraping ElastiCache, RDS, and other AWS managed service metrics via CloudWatch. Gated by `enable_cloudwatch_exporter` variable (default: false). Needed to support ElastiCache/RDS alerting on single-tenant clusters (DND-442).
1 parent 053d514 commit 76ab5ec

6 files changed

Lines changed: 99 additions & 0 deletions

File tree

main.tf

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -256,6 +256,9 @@ module "comet_eks" {
256256
enable_loki = var.enable_loki_bucket
257257
loki_s3_bucket_arn = var.enable_s3 && var.enable_loki_bucket ? module.comet_s3[0].comet_loki_bucket_arn : null
258258

259+
# CloudWatch Exporter IRSA for scraping AWS managed service metrics
260+
enable_cloudwatch_exporter = var.enable_cloudwatch_exporter
261+
259262
# Monitoring namespace and Grafana credentials
260263
enable_monitoring_setup = var.enable_monitoring_setup
261264
monitoring_namespace = var.monitoring_namespace

modules/comet_eks/main.tf

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -718,6 +718,70 @@ module "loki_irsa_role" {
718718
)
719719
}
720720

721+
##################################################
722+
#### CloudWatch Exporter IRSA Role and Policy ####
723+
##################################################
724+
data "aws_iam_policy_document" "cloudwatch_exporter" {
725+
count = var.enable_cloudwatch_exporter ? 1 : 0
726+
727+
statement {
728+
actions = [
729+
"cloudwatch:Describe*",
730+
"cloudwatch:Get*",
731+
"cloudwatch:List*",
732+
]
733+
resources = ["*"]
734+
}
735+
}
736+
737+
resource "aws_iam_policy" "cloudwatch_exporter" {
738+
count = var.enable_cloudwatch_exporter ? 1 : 0
739+
740+
name_prefix = "${var.environment}-cloudwatch-exporter-"
741+
description = "Provides CloudWatch read access for prometheus-cloudwatch-exporter on ${var.environment} cluster"
742+
policy = data.aws_iam_policy_document.cloudwatch_exporter[0].json
743+
744+
tags = merge(
745+
var.common_tags,
746+
{
747+
Name = "${var.environment}-cloudwatch-exporter"
748+
}
749+
)
750+
}
751+
752+
module "cloudwatch_exporter_irsa_role" {
753+
source = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts-eks"
754+
version = "~> 5.39"
755+
756+
count = var.enable_cloudwatch_exporter ? 1 : 0
757+
758+
role_name = "${var.environment}-cloudwatch-exporter"
759+
760+
role_policy_arns = {
761+
cloudwatch_exporter = aws_iam_policy.cloudwatch_exporter[0].arn
762+
}
763+
764+
oidc_providers = {
765+
ex = {
766+
provider_arn = module.eks.oidc_provider_arn
767+
namespace_service_accounts = ["monitoring:monitoring-prometheus-cloudwatch-exporter"]
768+
}
769+
}
770+
771+
depends_on = [
772+
module.eks,
773+
aws_iam_policy.cloudwatch_exporter
774+
]
775+
776+
tags = merge(
777+
var.common_tags,
778+
{
779+
Name = "${var.environment}-cloudwatch-exporter"
780+
Description = "IRSA role for prometheus-cloudwatch-exporter to scrape CloudWatch metrics"
781+
}
782+
)
783+
}
784+
721785
#########################################
722786
#### Monitoring Namespace and Secrets ####
723787
#########################################

modules/comet_eks/outputs.tf

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,16 @@ output "loki_irsa_role_name" {
4343
value = var.enable_loki ? module.loki_irsa_role[0].iam_role_name : null
4444
}
4545

46+
output "cloudwatch_exporter_irsa_role_arn" {
47+
description = "ARN of the CloudWatch Exporter IRSA role"
48+
value = var.enable_cloudwatch_exporter ? module.cloudwatch_exporter_irsa_role[0].iam_role_arn : null
49+
}
50+
51+
output "cloudwatch_exporter_irsa_role_name" {
52+
description = "Name of the CloudWatch Exporter IRSA role"
53+
value = var.enable_cloudwatch_exporter ? module.cloudwatch_exporter_irsa_role[0].iam_role_name : null
54+
}
55+
4656
output "karpenter_irsa_role_arn" {
4757
description = "ARN of the Karpenter controller IRSA role"
4858
value = var.enable_karpenter ? module.karpenter_irsa[0].iam_role_arn : null

modules/comet_eks/variables.tf

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -257,6 +257,12 @@ variable "enable_loki" {
257257
default = false
258258
}
259259

260+
variable "enable_cloudwatch_exporter" {
261+
description = "Enable CloudWatch Exporter IRSA role for scraping ElastiCache, RDS, and other AWS managed service metrics"
262+
type = bool
263+
default = false
264+
}
265+
260266
variable "loki_s3_bucket_arn" {
261267
description = "ARN of the S3 bucket for Loki log storage"
262268
type = string

outputs.tf

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -153,6 +153,16 @@ output "loki_irsa_role_name" {
153153
value = var.enable_eks && var.enable_loki_bucket ? module.comet_eks[0].loki_irsa_role_name : null
154154
}
155155

156+
output "cloudwatch_exporter_irsa_role_arn" {
157+
description = "ARN of the CloudWatch Exporter IRSA role"
158+
value = var.enable_eks && var.enable_cloudwatch_exporter ? module.comet_eks[0].cloudwatch_exporter_irsa_role_arn : null
159+
}
160+
161+
output "cloudwatch_exporter_irsa_role_name" {
162+
description = "Name of the CloudWatch Exporter IRSA role"
163+
value = var.enable_eks && var.enable_cloudwatch_exporter ? module.comet_eks[0].cloudwatch_exporter_irsa_role_name : null
164+
}
165+
156166
output "karpenter_irsa_role_arn" {
157167
description = "ARN of the Karpenter controller IRSA role — annotate the karpenter ServiceAccount with this"
158168
value = var.enable_eks && var.eks_enable_karpenter ? module.comet_eks[0].karpenter_irsa_role_arn : null

variables.tf

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -55,6 +55,12 @@ variable "eks_enable_karpenter" {
5555
default = false
5656
}
5757

58+
variable "enable_cloudwatch_exporter" {
59+
description = "Enable CloudWatch Exporter IRSA role for scraping ElastiCache, RDS, and other AWS managed service metrics (used by comet_eks module)"
60+
type = bool
61+
default = false
62+
}
63+
5864
variable "enable_monitoring_setup" {
5965
description = "Enable monitoring namespace and Grafana credentials secret in EKS (used by comet_eks module)"
6066
type = bool

0 commit comments

Comments
 (0)