Skip to content

Commit 5421ecf

Browse files
author
Mykhailo Babych
committed
chore: IAM modules upgrade
1 parent fe8c9b6 commit 5421ecf

5 files changed

Lines changed: 39 additions & 37 deletions

File tree

‎.pre-commit-config.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
repos:
22
- repo: https://github.com/antonbabenko/pre-commit-terraform
3-
rev: v1.86.0
3+
rev: v1.105.0
44
hooks:
55
- id: terraform_fmt
66
- id: terraform_validate

‎README.md‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -10,13 +10,13 @@ This module was created to simplify deploying Gitlab into the EKS with storage o
1010

1111
In the above diagram, you can see the components and their relations (PostgreSQL and Redis are not deployed with this module).
1212

13-
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
13+
<!-- BEGIN_TF_DOCS -->
1414
## Requirements
1515

1616
| Name | Version |
1717
|------|---------|
18-
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.0 |
19-
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | 5.36.0 |
18+
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.5.7 |
19+
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 6.0 |
2020
| <a name="requirement_helm"></a> [helm](#requirement\_helm) | 2.11.0 |
2121
| <a name="requirement_kubectl"></a> [kubectl](#requirement\_kubectl) | ~> 2.0 |
2222
| <a name="requirement_kubernetes"></a> [kubernetes](#requirement\_kubernetes) | >= 2.20 |
@@ -26,16 +26,16 @@ In the above diagram, you can see the components and their relations (PostgreSQL
2626

2727
| Name | Version |
2828
|------|---------|
29-
| <a name="provider_aws"></a> [aws](#provider\_aws) | 5.36.0 |
29+
| <a name="provider_aws"></a> [aws](#provider\_aws) | 6.36.0 |
3030
| <a name="provider_helm"></a> [helm](#provider\_helm) | 2.11.0 |
3131
| <a name="provider_kubernetes"></a> [kubernetes](#provider\_kubernetes) | 3.0.1 |
3232

3333
## Modules
3434

3535
| Name | Source | Version |
3636
|------|--------|---------|
37-
| <a name="module_gitlab_policy"></a> [gitlab\_policy](#module\_gitlab\_policy) | terraform-aws-modules/iam/aws//modules/iam-policy | v5.34.0 |
38-
| <a name="module_gitlab_role"></a> [gitlab\_role](#module\_gitlab\_role) | terraform-aws-modules/iam/aws//modules/iam-assumable-role-with-oidc | v5.34.0 |
37+
| <a name="module_gitlab_policy"></a> [gitlab\_policy](#module\_gitlab\_policy) | terraform-aws-modules/iam/aws//modules/iam-policy | v6.4.0 |
38+
| <a name="module_gitlab_role"></a> [gitlab\_role](#module\_gitlab\_role) | terraform-aws-modules/iam/aws//modules/iam-role | v6.4.0 |
3939
| <a name="module_s3_bucket"></a> [s3\_bucket](#module\_s3\_bucket) | terraform-aws-modules/s3-bucket/aws | 4.1.0 |
4040

4141
## Resources
@@ -52,9 +52,9 @@ In the above diagram, you can see the components and their relations (PostgreSQL
5252
| [kubernetes_secret_v1.redis](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/secret_v1) | resource |
5353
| [kubernetes_secret_v1.registry_postgres](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/secret_v1) | resource |
5454
| [kubernetes_secret_v1.smtp](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/secret_v1) | resource |
55-
| [aws_eks_cluster.eks](https://registry.terraform.io/providers/hashicorp/aws/5.36.0/docs/data-sources/eks_cluster) | data source |
56-
| [aws_iam_policy_document.s3_bucket_policy](https://registry.terraform.io/providers/hashicorp/aws/5.36.0/docs/data-sources/iam_policy_document) | data source |
57-
| [aws_region.current](https://registry.terraform.io/providers/hashicorp/aws/5.36.0/docs/data-sources/region) | data source |
55+
| [aws_eks_cluster.eks](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/eks_cluster) | data source |
56+
| [aws_iam_policy_document.s3_bucket_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
57+
| [aws_region.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/region) | data source |
5858

5959
## Inputs
6060

@@ -88,4 +88,4 @@ In the above diagram, you can see the components and their relations (PostgreSQL
8888
| <a name="output_buckets"></a> [buckets](#output\_buckets) | List of buckets created |
8989
| <a name="output_role_arn"></a> [role\_arn](#output\_role\_arn) | ARN of IAM role |
9090
| <a name="output_role_name"></a> [role\_name](#output\_role\_name) | Name of IAM role |
91-
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
91+
<!-- END_TF_DOCS -->

‎main.tf‎

Lines changed: 24 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -147,7 +147,7 @@ data "aws_iam_policy_document" "s3_bucket_policy" {
147147
effect = "Allow"
148148
principals {
149149
type = "AWS"
150-
identifiers = [module.gitlab_role.iam_role_arn]
150+
identifiers = [module.gitlab_role.arn]
151151
}
152152
actions = ["s3:ListBucket"]
153153
resources = ["arn:aws:s3:::${each.value}"]
@@ -158,7 +158,7 @@ data "aws_iam_policy_document" "s3_bucket_policy" {
158158
effect = "Allow"
159159
principals {
160160
type = "AWS"
161-
identifiers = [module.gitlab_role.iam_role_arn]
161+
identifiers = [module.gitlab_role.arn]
162162
}
163163
actions = ["s3:PutObject", "s3:GetObject"]
164164
resources = ["arn:aws:s3:::${each.value}/*"]
@@ -169,7 +169,7 @@ data "aws_iam_policy_document" "s3_bucket_policy" {
169169
effect = "Allow"
170170
principals {
171171
type = "AWS"
172-
identifiers = [module.gitlab_role.iam_role_arn]
172+
identifiers = [module.gitlab_role.arn]
173173
}
174174
actions = ["s3:DeleteObject"]
175175
resources = ["arn:aws:s3:::${each.value}/*"]
@@ -180,7 +180,7 @@ data "aws_iam_policy_document" "s3_bucket_policy" {
180180
effect = "Allow"
181181
principals {
182182
type = "AWS"
183-
identifiers = [module.gitlab_role.iam_role_arn]
183+
identifiers = [module.gitlab_role.arn]
184184
}
185185
actions = ["s3:PutObjectAcl"]
186186
resources = ["arn:aws:s3:::${each.value}/*"]
@@ -191,7 +191,7 @@ data "aws_iam_policy_document" "s3_bucket_policy" {
191191
effect = "Allow"
192192
principals {
193193
type = "AWS"
194-
identifiers = [module.gitlab_role.iam_role_arn]
194+
identifiers = [module.gitlab_role.arn]
195195
}
196196
actions = ["s3:GetObjectAcl"]
197197
resources = ["arn:aws:s3:::${each.value}/*"]
@@ -202,7 +202,7 @@ data "aws_iam_policy_document" "s3_bucket_policy" {
202202
effect = "Allow"
203203
principals {
204204
type = "AWS"
205-
identifiers = [module.gitlab_role.iam_role_arn]
205+
identifiers = [module.gitlab_role.arn]
206206
}
207207
actions = ["s3:ListBucketMultipartUploads"]
208208
resources = ["arn:aws:s3:::${each.value}"]
@@ -213,7 +213,7 @@ data "aws_iam_policy_document" "s3_bucket_policy" {
213213
effect = "Allow"
214214
principals {
215215
type = "AWS"
216-
identifiers = [module.gitlab_role.iam_role_arn]
216+
identifiers = [module.gitlab_role.arn]
217217
}
218218
actions = ["s3:ListMultipartUploadParts"]
219219
resources = ["arn:aws:s3:::${each.value}/*"]
@@ -265,7 +265,7 @@ resource "helm_release" "gitlab" {
265265

266266
set {
267267
name = "global.serviceAccount.annotations.eks\\.amazonaws\\.com/role-arn"
268-
value = module.gitlab_role.iam_role_arn
268+
value = module.gitlab_role.arn
269269
}
270270

271271
depends_on = [
@@ -278,7 +278,7 @@ resource "helm_release" "gitlab" {
278278

279279
module "gitlab_policy" {
280280
source = "terraform-aws-modules/iam/aws//modules/iam-policy"
281-
version = "v5.34.0"
281+
version = "v6.4.0"
282282

283283
name = "gitlab-role-policy"
284284
description = "Policy for GitLab role"
@@ -288,20 +288,22 @@ module "gitlab_policy" {
288288
}
289289

290290
module "gitlab_role" {
291-
source = "terraform-aws-modules/iam/aws//modules/iam-assumable-role-with-oidc"
292-
version = "v5.34.0"
293-
create_role = true
294-
allow_self_assume_role = false
295-
role_description = "Gitlab Role to access AWS resources"
296-
role_name = "${var.release_name}-${var.role_suffix}"
297-
role_policy_arns = [
298-
module.gitlab_policy.arn
299-
]
291+
source = "terraform-aws-modules/iam/aws//modules/iam-role"
292+
version = "v6.4.0"
293+
294+
enable_oidc = true
295+
name = "${var.release_name}-${var.role_suffix}"
296+
description = "Gitlab Role to access AWS resources"
297+
298+
oidc_provider_urls = [data.aws_eks_cluster.eks.identity[0].oidc[0].issuer]
299+
oidc_wildcard_subjects = ["system:serviceaccount:${local.release_namespace}:gitlab*"]
300+
oidc_audiences = ["[sts.amazonaws.com](http://sts.amazonaws.com)"]
300301

301-
provider_url = data.aws_eks_cluster.eks.identity[0].oidc[0].issuer
302-
oidc_subjects_with_wildcards = ["system:serviceaccount:${local.release_namespace}:gitlab*"]
303-
oidc_fully_qualified_audiences = ["sts.amazonaws.com"]
304-
tags = var.tags
302+
policies = {
303+
gitlab-role-policy = module.gitlab_policy.arn
304+
}
305+
306+
tags = var.tags
305307

306308
depends_on = [
307309
module.gitlab_policy

‎outputs.tf‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,11 @@
11
output "role_name" {
22
description = "Name of IAM role"
3-
value = module.gitlab_role.iam_role_name
3+
value = module.gitlab_role.arn
44
}
55

66
output "role_arn" {
77
description = "ARN of IAM role"
8-
value = module.gitlab_role.iam_role_arn
8+
value = module.gitlab_role.arn
99

1010
}
1111

‎versions.tf‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,10 @@
11
terraform {
2-
required_version = ">= 1.0"
2+
required_version = ">= 1.5.7"
33

44
required_providers {
55
aws = {
66
source = "hashicorp/aws"
7-
version = "5.36.0"
7+
version = ">= 6.0"
88
}
99
helm = {
1010
source = "hashicorp/helm"

0 commit comments

Comments
 (0)