EKS Pod Identity
Terraform module to create AWS EKS Pod Identity resources
Inputs
40 / 80
additional_policy_arnsoptionalmap(string)ARNs of additional policies to attach to the IAM role
{}amazon_managed_service_prometheus_policy_nameoptionalstringCustom name of the Amazon Managed Service for Prometheus IAM policy
nullamazon_managed_service_prometheus_workspace_arnsoptionallist(string)List of AMP Workspace ARNs to read and write metrics
[]appmesh_controller_policy_nameoptionalstringCustom name of the AppMesh Controller IAM policy
nullappmesh_envoy_proxy_policy_nameoptionalstringCustom name of the AppMesh Envoy Proxy IAM policy
nullassociation_defaultsoptionalobject({ cluster_name = optional(string) disable_session_tags = optional(bool) n…Default values used across all Pod Identity associations created unless a more specific value is provided
{}associationsoptionalmap(object({ cluster_name = optional(string) disable_session_tags = optional(boo…Map of Pod Identity associations to be created (map of maps)
{}attach_amazon_managed_service_prometheus_policyoptionalboolDetermines whether to attach the Amazon Managed Service for Prometheus IAM policy to the role
falseattach_aws_appmesh_controller_policyoptionalboolDetermines whether to attach the AppMesh Controller policy to the role
falseattach_aws_appmesh_envoy_proxy_policyoptionalboolDetermines whether to attach the AppMesh Envoy Proxy policy to the role
falseattach_aws_cloudwatch_observability_policyoptionalboolDetermines whether to attach the AWS Cloudwatch Observability IAM policy to the role
falseattach_aws_ebs_csi_policyoptionalboolDetermines whether to attach the EBS CSI IAM policy to the role
falseattach_aws_efs_csi_policyoptionalboolDetermines whether to attach the EFS CSI IAM policy to the role
falseattach_aws_fsx_lustre_csi_policyoptionalboolDetermines whether to attach the FSx for Lustre CSI Driver IAM policy to the role
falseattach_aws_gateway_controller_policyoptionalboolDetermines whether to attach the AWS Gateway Controller IAM policy to the role
falseattach_aws_lb_controller_policyoptionalboolDetermines whether to attach the AWS Load Balancer Controller policy to the role
falseattach_aws_lb_controller_targetgroup_binding_only_policyoptionalboolDetermines whether to attach the AWS Load Balancer Controller policy for the TargetGroupBinding only
falseattach_aws_node_termination_handler_policyoptionalboolDetermines whether to attach the Node Termination Handler policy to the role
falseattach_aws_privateca_issuer_policyoptionalboolDetermines whether to attach the AWS Private CA Issuer IAM policy to the role
falseattach_aws_vpc_cni_policyoptionalboolDetermines whether to attach the VPC CNI IAM policy to the role
falseattach_cert_manager_policyoptionalboolDetermines whether to attach the Cert Manager IAM policy to the role
falseattach_cluster_autoscaler_policyoptionalboolDetermines whether to attach the Cluster Autoscaler IAM policy to the role
falseattach_custom_policyoptionalboolDetermines whether to attach the custom IAM policy to the role
falseattach_external_dns_policyoptionalboolDetermines whether to attach the External DNS IAM policy to the role
falseattach_external_secrets_policyoptionalboolDetermines whether to attach the External Secrets policy to the role
falseattach_mountpoint_s3_csi_policyoptionalboolDetermines whether to attach the Mountpoint S3 CSI IAM policy to the role
falseattach_pganalyze_policyoptionalboolDetermines whether to attach the PGAnalyze IAM policy to the role
falseattach_velero_policyoptionalboolDetermines whether to attach the Velero IAM policy to the role
falseaws_ebs_csi_kms_arnsoptionallist(string)KMS key ARNs to allow EBS CSI to manage encrypted volumes
[]aws_ebs_csi_policy_nameoptionalstringCustom name of the EBS CSI IAM policy
nullaws_efs_csi_policy_nameoptionalstringCustom name of the EFS CSI IAM policy
nullaws_fsx_lustre_csi_policy_nameoptionalstringCustom name of the FSx for Lustre CSI Driver IAM policy
nullaws_fsx_lustre_csi_service_role_arnsoptionallist(string)Service role ARNs to allow FSx for Lustre CSI create and manage FSX for Lustre service linked roles
[]aws_gateway_controller_policy_nameoptionalstringCustom name of the AWS Gateway Controller IAM policy
nullaws_lb_controller_policy_nameoptionalstringCustom name of the AWS Load Balancer Controller IAM policy
nullaws_lb_controller_targetgroup_arnsoptionallist(string)List of Target groups ARNs using Load Balancer Controller
[]aws_lb_controller_targetgroup_only_policy_nameoptionalstringCustom name of the AWS Load Balancer Controller IAM policy for the TargetGroupBinding only
nullaws_node_termination_handler_policy_nameoptionalstringCustom name of the Node Termination Handler IAM policy
nullaws_node_termination_handler_sqs_queue_arnsoptionallist(string)List of SQS ARNs that contain node termination events
[]aws_privateca_issuer_acmca_arnsoptionallist(string)List of ACM Private CA ARNs to issue certificates from
[]All 80 are optional — the module deploys with none of them set. Showing 40, so the site stays a static download — the remaining 40 are in the source.
Outputs
8
associationsMap of Pod Identity associations created
iam_policy_arnThe ARN assigned by AWS to this policy
iam_policy_idThe policy's ID
iam_policy_nameName of IAM policy
iam_role_arnARN of IAM role
iam_role_nameName of IAM role
iam_role_pathPath of IAM role
iam_role_unique_idUnique ID of IAM role
What the agent wires into the next module. An edge on the architecture diagram is one of these consumed by something else.