Save the cluster creator role

[nitrocode]

Have a question? Please checkout our Slack Community or visit our Slack Archive.

Describe the Feature

Save the cluster creator role in SSM and add to the cluster as a tag

Use Case

If the user is locked out and the cloudtrail event is missing, an aws support ticket needs to be creator to find the ClusterCreator event to dig out the iam role, then the iam role can be assumed to update the kube config map to get access again.

Describe Ideal Solution

Save the cluster creator role in SSM and add to the cluster as a tag. If we get the value of the tag from SSM and put a lifecycle ignore changes on the SSM param value, then subsequent applies by a different role will not update the SSM value.

Alternatives Considered

N/A

Additional Context

• Save the eks cluster creator role/user in tfstate hashicorp/terraform-provider-aws#26829

[nnsense]

In all honesty, it's not really a requirement the majority would expect to find in a shared module, it seems more like a personal needing to me, most of us aren't relying at all to that initial role.
First and foremost, you should deploy using a pipeline which should be set with a pre-definied role, so you shouldn't wonder what it was, also because you usually want to set a specific role with the right permission to deploy not a multitude of roles. If you have a a number of devs deploying clusters, then you can use something like terragrunt to set a tag for you:

createdby = split("/", get_aws_caller_identity_arn())[1]

Or you can use plain terraform with data "aws_caller_identity" "current" {} to get the arn and set it as a tag.

Anyway, in my opinion the best choice is to add a predefined role using the map_additional_iam_roles feature of this module, first you're not exposing anything as a tag. and second getting the exact role might be challenging if there an "assume_role" in the mix.

[Gowiem]

I think this is a smart move to implement 👍 Would definitely save a bunch of people who aren't sophisticated terraform / EKS operators from losing track of the role / user that created their cluster.