new(ebs-csi-controller): ad-hoc iam role for ebs-csi-controller

Signed-off-by: Aldo Lacuku <[email protected]>

config/clusters/iam.tf

@@ -2,6 +2,25 @@ data "aws_canonical_user_id" "current_user" {}
 
 data "aws_caller_identity" "current" {}
 
+##### EBS CSI controller
+
+module "ebs_csi_controller" {
+  source           = "terraform-aws-modules/iam/aws//modules/iam-assumable-role-with-oidc"
+  version          = "4.1.0"
+  create_role      = true
+  role_name        = "${local.cluster_name}-ebs-csi-controller"
+  provider_url     = replace(module.eks.cluster_oidc_issuer_url, "https://", "")
+  role_policy_arns = [aws_iam_policy.ebs_controller_policy.arn]
+  oidc_fully_qualified_subjects = [
+    "system:serviceaccount:kube-system:ebs-csi-controller-sa",
+  ]
+}
+
+resource "aws_iam_policy" "ebs_controller_policy" {
+  name_prefix = "${local.cluster_name}-ebs-csi-driver"
+  policy      = data.aws_iam_policy_document.ebs_controller_policy_doc.json
+}
+
 data "aws_iam_policy_document" "ebs_controller_policy_doc" {
   statement {
     effect    = "Allow"
@@ -26,11 +45,6 @@ data "aws_iam_policy_document" "ebs_controller_policy_doc" {
   }
 }
 
-resource "aws_iam_policy" "ebs_controller_policy" {
-  name_prefix = "${local.cluster_name}-ebs-csi-driver"
-  policy      = data.aws_iam_policy_document.ebs_controller_policy_doc.json
-}
-
 ##### Cluster-autoscaler
 
 module "cluster_autoscaler" {

config/prow/ebs-csi-driver/ebs-csi-controller.yaml

@@ -4,6 +4,8 @@ kind: ServiceAccount
 metadata:
   labels:
     app.kubernetes.io/name: aws-ebs-csi-driver
+  annotations:
+    eks.amazonaws.com/role-arn: arn:aws:iam::292999226676:role/falco-prow-test-infra-ebs-csi-controller
   name: ebs-csi-controller-sa
   namespace: kube-system
 ---