feat(iam-role-for-service-accounts-eks): Introduce adot collector

examples/iam-role-for-service-accounts-eks/README.md

@@ -32,6 +32,7 @@ Run `terraform destroy` when you don't need these resources.
 
 | Name | Source | Version |
 |------|--------|---------|
+| <a name="module_adot_collector_irsa_role"></a> [adot\_collector\_irsa\_role](#module\_adot\_collector\_irsa\_role) | ../../modules/iam-role-for-service-accounts-eks | n/a |
 | <a name="module_amazon_managed_service_prometheus_irsa_role"></a> [amazon\_managed\_service\_prometheus\_irsa\_role](#module\_amazon\_managed\_service\_prometheus\_irsa\_role) | ../../modules/iam-role-for-service-accounts-eks | n/a |
 | <a name="module_appmesh_controller_irsa_role"></a> [appmesh\_controller\_irsa\_role](#module\_appmesh\_controller\_irsa\_role) | ../../modules/iam-role-for-service-accounts-eks | n/a |
 | <a name="module_appmesh_envoy_proxy_irsa_role"></a> [appmesh\_envoy\_proxy\_irsa\_role](#module\_appmesh\_envoy\_proxy\_irsa\_role) | ../../modules/iam-role-for-service-accounts-eks | n/a |

examples/iam-role-for-service-accounts-eks/main.tf

@@ -350,6 +350,24 @@ module "vpc_cni_ipv6_irsa_role" {
   tags = local.tags
 }
 
+module "adot_collector_irsa_role" {
+  source = "../../modules/iam-role-for-service-accounts-eks"
+
+  role_name                                    = "adot-collector"
+  attach_amazon_prometheus_remote_write_policy = true
+  attach_aws_xray_write_only_access_policy     = true
+  attach_cloudwatch_agent_server_policy        = true
+
+  oidc_providers = {
+    ex = {
+      provider_arn               = module.eks.oidc_provider_arn
+      namespace_service_accounts = ["opentelemetry-operator-system:adot-collector"]
+    }
+  }
+
+  tags = local.tags
+}
+
 ################################################################################
 # Custom IRSA Roles
 ################################################################################

modules/iam-role-for-service-accounts-eks/README.md

@@ -139,6 +139,9 @@ No modules.
 | [aws_iam_policy.velero](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
 | [aws_iam_policy.vpc_cni](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
 | [aws_iam_role.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |
+| [aws_iam_role_policy_attachment.adot_collector_cloudwatch_agent](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
+| [aws_iam_role_policy_attachment.adot_collector_prometheus](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
+| [aws_iam_role_policy_attachment.adot_collector_xray](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
 | [aws_iam_role_policy_attachment.amazon_managed_service_prometheus](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
 | [aws_iam_role_policy_attachment.appmesh_controller](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
 | [aws_iam_role_policy_attachment.appmesh_envoy_proxy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
@@ -187,10 +190,13 @@ No modules.
 | <a name="input_amazon_managed_service_prometheus_workspace_arns"></a> [amazon\_managed\_service\_prometheus\_workspace\_arns](#input\_amazon\_managed\_service\_prometheus\_workspace\_arns) | List of AMP Workspace ARNs to read and write metrics | `list(string)` | <pre>[<br>  "*"<br>]</pre> | no |
 | <a name="input_assume_role_condition_test"></a> [assume\_role\_condition\_test](#input\_assume\_role\_condition\_test) | Name of the [IAM condition operator](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html) to evaluate when assuming the role | `string` | `"StringEquals"` | no |
 | <a name="input_attach_amazon_managed_service_prometheus_policy"></a> [attach\_amazon\_managed\_service\_prometheus\_policy](#input\_attach\_amazon\_managed\_service\_prometheus\_policy) | Determines whether to attach the Amazon Managed Service for Prometheus IAM policy to the role | `bool` | `false` | no |
+| <a name="input_attach_amazon_prometheus_remote_write_policy"></a> [attach\_amazon\_prometheus\_remote\_write\_policy](#input\_attach\_amazon\_prometheus\_remote\_write\_policy) | Determines whether to attach the aws managed AmazonPrometheusRemoteWriteAccess policy to the role | `bool` | `false` | no |
 | <a name="input_attach_appmesh_controller_policy"></a> [attach\_appmesh\_controller\_policy](#input\_attach\_appmesh\_controller\_policy) | Determines whether to attach the Appmesh Controller policy to the role | `bool` | `false` | no |
 | <a name="input_attach_appmesh_envoy_proxy_policy"></a> [attach\_appmesh\_envoy\_proxy\_policy](#input\_attach\_appmesh\_envoy\_proxy\_policy) | Determines whether to attach the Appmesh envoy proxy policy to the role | `bool` | `false` | no |
 | <a name="input_attach_aws_gateway_controller_policy"></a> [attach\_aws\_gateway\_controller\_policy](#input\_attach\_aws\_gateway\_controller\_policy) | Determines whether to attach the AWS Gateway Controller IAM policy to the role | `bool` | `false` | no |
+| <a name="input_attach_aws_xray_write_only_access_policy"></a> [attach\_aws\_xray\_write\_only\_access\_policy](#input\_attach\_aws\_xray\_write\_only\_access\_policy) | Determines whether to attach the aws managed AWSXrayWriteOnlyAccess policy to the role | `bool` | `false` | no |
 | <a name="input_attach_cert_manager_policy"></a> [attach\_cert\_manager\_policy](#input\_attach\_cert\_manager\_policy) | Determines whether to attach the Cert Manager IAM policy to the role | `bool` | `false` | no |
+| <a name="input_attach_cloudwatch_agent_server_policy"></a> [attach\_cloudwatch\_agent\_server\_policy](#input\_attach\_cloudwatch\_agent\_server\_policy) | Determines whether to attach the aws managed CloudWatchAgentServerPolicy policy to the role | `bool` | `false` | no |
 | <a name="input_attach_cluster_autoscaler_policy"></a> [attach\_cluster\_autoscaler\_policy](#input\_attach\_cluster\_autoscaler\_policy) | Determines whether to attach the Cluster Autoscaler IAM policy to the role | `bool` | `false` | no |
 | <a name="input_attach_ebs_csi_policy"></a> [attach\_ebs\_csi\_policy](#input\_attach\_ebs\_csi\_policy) | Determines whether to attach the EBS CSI IAM policy to the role | `bool` | `false` | no |
 | <a name="input_attach_efs_csi_policy"></a> [attach\_efs\_csi\_policy](#input\_attach\_efs\_csi\_policy) | Determines whether to attach the EFS CSI IAM policy to the role | `bool` | `false` | no |

modules/iam-role-for-service-accounts-eks/policies.tf

@@ -1401,3 +1401,28 @@ resource "aws_iam_role_policy_attachment" "vpc_cni" {
   role       = aws_iam_role.this[0].name
   policy_arn = aws_iam_policy.vpc_cni[0].arn
 }
+
+################################################################################
+# ADOT collector Policy
+################################################################################
+
+resource "aws_iam_role_policy_attachment" "adot_collector_prometheus" {
+  count = var.create_role && var.attach_amazon_prometheus_remote_write_policy ? 1 : 0
+
+  role       = aws_iam_role.this[0].name
+  policy_arn = "arn:aws:iam::aws:policy/AmazonPrometheusRemoteWriteAccess"
+}
+
+resource "aws_iam_role_policy_attachment" "adot_collector_xray" {
+  count = var.create_role && var.attach_aws_xray_write_only_access_policy ? 1 : 0
+
+  role       = aws_iam_role.this[0].name
+  policy_arn = "arn:aws:iam::aws:policy/AWSXrayWriteOnlyAccess"
+}
+
+resource "aws_iam_role_policy_attachment" "adot_collector_cloudwatch_agent" {
+  count = var.create_role && var.attach_cloudwatch_agent_server_policy ? 1 : 0
+
+  role       = aws_iam_role.this[0].name
+  policy_arn = "arn:aws:iam::aws:policy/CloudWatchAgentServerPolicy"
+}

modules/iam-role-for-service-accounts-eks/variables.tf

@@ -332,3 +332,22 @@ variable "node_termination_handler_sqs_queue_arns" {
   type        = list(string)
   default     = ["*"]
 }
+
+# ADOT collector
+variable "attach_amazon_prometheus_remote_write_policy" {
+  description = "Determines whether to attach the aws managed AmazonPrometheusRemoteWriteAccess policy to the role"
+  type        = bool
+  default     = false
+}
+
+variable "attach_aws_xray_write_only_access_policy" {
+  description = "Determines whether to attach the aws managed AWSXrayWriteOnlyAccess policy to the role"
+  type        = bool
+  default     = false
+}
+
+variable "attach_cloudwatch_agent_server_policy" {
+  description = "Determines whether to attach the aws managed CloudWatchAgentServerPolicy policy to the role"
+  type        = bool
+  default     = false
+}

wrappers/iam-role-for-service-accounts-eks/main.tf

@@ -55,4 +55,7 @@ module "wrapper" {
   vpc_cni_enable_ipv6                                             = try(each.value.vpc_cni_enable_ipv6, var.defaults.vpc_cni_enable_ipv6, false)
   attach_node_termination_handler_policy                          = try(each.value.attach_node_termination_handler_policy, var.defaults.attach_node_termination_handler_policy, false)
   node_termination_handler_sqs_queue_arns                         = try(each.value.node_termination_handler_sqs_queue_arns, var.defaults.node_termination_handler_sqs_queue_arns, ["*"])
+  attach_amazon_prometheus_remote_write_policy                    = try(each.value.attach_amazon_prometheus_remote_write_policy, var.defaults.attach_amazon_prometheus_remote_write_policy, false)
+  attach_aws_xray_write_only_access_policy                        = try(each.value.attach_aws_xray_write_only_access_policy, var.defaults.attach_aws_xray_write_only_access_policy, false)
+  attach_cloudwatch_agent_server_policy                           = try(each.value.attach_cloudwatch_agent_server_policy, var.defaults.attach_cloudwatch_agent_server_policy, false)
 }