ekscsism_aws_eks_cluster.tf

resource "aws_iam_role" "app1_eks_role" {
  name               = "app1_eks_role"
  assume_role_policy = data.aws_iam_policy_document.app1_eks_assume_role_policy.json
}
resource "aws_iam_policy" "retrieve_secret" {
  name        = "app1_retrieve_secret"
  path        = "/"
  description = "IAM secret EKS"
  policy = jsonencode(
    {
      Version = "2012-10-17"
      Statement = [
        {
          "Effect" : "Allow",
          "Action" : [
            "secretsmanager:GetSecretValue",
            "secretsmanager:DescribeSecret"
          ],
          "Resource" : [
            "arn:aws:secretsmanager:${data.aws_region.current.name}:${data.aws_caller_identity.current.account_id}:secret:app1*"
          ]
        }
      ]
    }
  )
}
resource "aws_iam_role_policy_attachment" "app1_eks_secret_retireve_attach" {
  role       = aws_iam_role.app1_eks_role.name
  policy_arn = aws_iam_policy.retrieve_secret.arn
}