Prevent creating log group by the iam role

[nitrocode]

what

• Prevent creating log group by the iam role

why

See: hashicorp/terraform#14750, terraform-aws-modules/terraform-aws-eks#920

This is happening because EKS Cluster gets destroyed after Terraform delete the Cloudwatch Log Group. The AmazonEKSServicePolicy IAM policy (that is assigned to EKS Cluster role by default within this module) has permissions to CreateLogGroup and anything else needed to continue to logging correctly. When the Terraform destroys the Cloudwatch Log Group, the EKS Cluster that is running create it again. Then, when you run Terraform Apply again, the Cloudwatch Log Group doesn't exist in your state anymore (because the Terraform actually destroyed it) and the Terraform doesn't know this resource created outside him. terraform-aws-modules/terraform-aws-eks/issues/920

references

• Closes Creating CloudWatch Log Group failed: ResourceAlreadyExistsException: #67
• Original fix fix: Added Deny for CreateLogGroup action in EKS cluster role terraform-aws-modules/terraform-aws-eks#1594 thanks to @haarchri and thanks to @Nuru for pointing out the fix

[nitrocode]

/test all

[Gowiem]

Funky bug, but looks like a good fix 👍

[Nuru]

@nitrocode @Gowiem For future reference, as shown in #135, it does not work to have multiple aws_iam_role_policy resources attached to a single role. If we need multiple policies, then we combine policies into one aws_iam_role_policy by using an aws_iam_policy_document data source, or create multiple aws_iam_policy resources and attach them via aws_iam_role_policy_attachment resources. The latter is more flexible and generally better, because it allows other Terraform (or other actors) to attach additional policies that this Terraform will not manage/remove, but there is a limit of 10 attachments per role (can be raised to 20), which we can run into if we are not careful.