Create role for PKS

pks_iam.tf

resource "aws_iam_policy" "pks_master_policy" {
  name   = "${var.env_name}_pks_master_policy"
  policy = "${data.template_file.pks_master_policy.rendered}"
  count  = "${var.count}"
}

resource "aws_iam_role" "pks_master_role" {
  name = "${var.env_name}_pks_master_role"

  lifecycle {
    create_before_destroy = true
  }
  assume_role_policy = <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": [
          "ec2.amazonaws.com"
        ]
      },
      "Action": [
        "sts:AssumeRole"
      ]
    }
  ]
}
EOF
}

resource "aws_iam_instance_profile" "pks_master_profile" {
  name = "${var.env_name}_pks_master_profile"
  role = "${aws_iam_role.pks_master_role.name}"

  lifecycle {
    ignore_changes = ["name"]
  }
}

resource "aws_iam_role_policy_attachment" "pks_master_policy" {
  role       = "${aws_iam_role.pks_master_role.name}"
  policy_arn = "${aws_iam_policy.pks_master_policy.arn}"
  count      = "${var.count}"
}

data "template_file" "pks_master_policy" {
  template = "${file("${path.module}/templates/pks_master_policy.json")}"
  count    = "${var.count}"

  vars {
    iam_instance_profile_arn = "${var.instance_profile_arn}"
    iam_ops_manager_role_arn = "${var.iam_ops_manager_role_arn}"
  }
}


resource "aws_iam_policy" "pks_worker_policy" {
  name   = "${var.env_name}_pks_worker_policy"
  policy = "${data.template_file.pks_worker_policy.rendered}"
  count  = "${var.count}"
}

resource "aws_iam_role" "pks_worker_role" {
  name = "${var.env_name}_pks_worker_role"

  lifecycle {
    create_before_destroy = true
  }
  assume_role_policy = <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": [
          "ec2.amazonaws.com"
        ]
      },
      "Action": [
        "sts:AssumeRole"
      ]
    }
  ]
}
EOF
}

resource "aws_iam_instance_profile" "pks_worker_profile" {
  name = "${var.env_name}_pks_worker_profile"
  role = "${aws_iam_role.pks_worker_role.name}"

  lifecycle {
    ignore_changes = ["name"]
  }
}

resource "aws_iam_role_policy_attachment" "pks_worker_policy" {
  role       = "${aws_iam_role.pks_worker_role.name}"
  policy_arn = "${aws_iam_policy.pks_worker_policy.arn}"
  count      = "${var.count}"
}

data "template_file" "pks_worker_policy" {
  template = "${file("${path.module}/templates/pks_worker_policy.json")}"
  count    = "${var.count}"

  vars {
    iam_instance_profile_arn = "${var.instance_profile_arn}"
    iam_ops_manager_role_arn = "${var.iam_ops_manager_role_arn}"
  }
}

pks_master_policy.json

{
   "Version": "2012-10-17",
   "Statement": [
       {
           "Effect": "Allow",
           "Action": "s3:*",
           "Resource": [
               "arn:aws:s3:::kubernetes-*"
           ]
       },
       {
           "Effect": "Allow",
           "Action": "ec2:Describe*",
           "Resource": "*"
       },
       {
           "Effect": "Allow",
           "Action": "ec2:AttachVolume",
           "Resource": "*"
       },
       {
           "Effect": "Allow",
           "Action": "ec2:DetachVolume",
           "Resource": "*"
       },
       {
           "Effect": "Allow",
           "Action": [
               "ec2:*"
           ],
           "Resource": [
               "*"
           ]
       },
       {
           "Effect": "Allow",
           "Action": [
               "elasticloadbalancing:*"
           ],
           "Resource": [
               "*"
           ]
       }
     ]
}

pks_worker_policy.json

{
  "Version": "2012-10-17",
  "Statement": [
      {
          "Action": "ec2:Describe*",
          "Effect": "Allow",
          "Resource": "*"
      },
      {
          "Action": "ec2:AttachVolume",
          "Effect": "Allow",
          "Resource": "*"
      },
      {
          "Action": "ec2:DetachVolume",
          "Effect": "Allow",
          "Resource": "*"
      }
  ]
 }