Skip to content

Commit 0712293

Browse files
magreenbaummagreenbaum
authored
feat: Allow passing in custom instance profile role (#30)
1 parent d71a224 commit 0712293

File tree

21 files changed

+127
-29
lines changed

21 files changed

+127
-29
lines changed

‎README.md‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -330,13 +330,13 @@ Examples codified under the [`examples`](https://github.com/terraform-aws-module
330330
| Name | Version |
331331
|------|---------|
332332
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.0 |
333-
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 5.59 |
333+
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 5.65 |
334334

335335
## Providers
336336

337337
| Name | Version |
338338
|------|---------|
339-
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 5.59 |
339+
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 5.65 |
340340

341341
## Modules
342342

@@ -402,6 +402,7 @@ No modules.
402402
| <a name="input_iam_instance_profile_description"></a> [iam\_instance\_profile\_description](#input\_iam\_instance\_profile\_description) | Description of the EC2 IAM role/instance profile | `string` | `null` | no |
403403
| <a name="input_iam_instance_profile_name"></a> [iam\_instance\_profile\_name](#input\_iam\_instance\_profile\_name) | Name to use on EC2 IAM role/instance profile created | `string` | `null` | no |
404404
| <a name="input_iam_instance_profile_policies"></a> [iam\_instance\_profile\_policies](#input\_iam\_instance\_profile\_policies) | Map of IAM policies to attach to the EC2 IAM role/instance profile | `map(string)` | <pre>{<br> "AmazonElasticMapReduceforEC2Role": "arn:aws:iam::aws:policy/service-role/AmazonElasticMapReduceforEC2Role"<br>}</pre> | no |
405+
| <a name="input_iam_instance_profile_role_arn"></a> [iam\_instance\_profile\_role\_arn](#input\_iam\_instance\_profile\_role\_arn) | The ARN of an existing IAM role to use if passing in a custom instance profile and creating a service role | `string` | `null` | no |
405406
| <a name="input_iam_role_path"></a> [iam\_role\_path](#input\_iam\_role\_path) | IAM role path | `string` | `null` | no |
406407
| <a name="input_iam_role_permissions_boundary"></a> [iam\_role\_permissions\_boundary](#input\_iam\_role\_permissions\_boundary) | ARN of the policy that is used to set the permissions boundary for the IAM role | `string` | `null` | no |
407408
| <a name="input_iam_role_tags"></a> [iam\_role\_tags](#input\_iam\_role\_tags) | A map of additional tags to add to the IAM role created | `map(string)` | `{}` | no |

‎examples/private-cluster/README.md‎

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -28,13 +28,13 @@ Note that this example may create resources which will incur monetary charges on
2828
| Name | Version |
2929
|------|---------|
3030
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.0 |
31-
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 5.59 |
31+
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 5.65 |
3232

3333
## Providers
3434

3535
| Name | Version |
3636
|------|---------|
37-
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 5.59 |
37+
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 5.65 |
3838

3939
## Modules
4040

@@ -52,7 +52,17 @@ Note that this example may create resources which will incur monetary charges on
5252

5353
| Name | Type |
5454
|------|------|
55+
| [aws_iam_instance_profile.custom_instance_profile](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_instance_profile) | resource |
56+
| [aws_iam_role.autoscaling](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |
57+
| [aws_iam_role.custom_instance_profile](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |
58+
| [aws_iam_role_policy_attachment.autoscaling](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
59+
| [aws_iam_role_policy_attachment.emr_for_ec2](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
5560
| [aws_availability_zones.available](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/availability_zones) | data source |
61+
| [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |
62+
| [aws_iam_policy_document.assume](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
63+
| [aws_iam_policy_document.autoscaling](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
64+
| [aws_partition.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/partition) | data source |
65+
| [aws_region.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/region) | data source |
5666

5767
## Inputs
5868

‎examples/private-cluster/main.tf‎

Lines changed: 81 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,12 @@ provider "aws" {
44

55
data "aws_availability_zones" "available" {}
66

7+
data "aws_partition" "current" {}
8+
9+
data "aws_caller_identity" "current" {}
10+
11+
data "aws_region" "current" {}
12+
713
locals {
814
name = replace(basename(path.cwd), "-cluster", "")
915
region = "eu-west-1"
@@ -158,7 +164,9 @@ module "emr_instance_fleet" {
158164
module "emr_instance_group" {
159165
source = "../.."
160166

161-
name = "${local.name}-instance-group"
167+
name = "${local.name}-instance-group"
168+
create_iam_instance_profile = false
169+
create_autoscaling_iam_role = false
162170

163171
release_label_filters = {
164172
emr6 = {
@@ -230,8 +238,12 @@ module "emr_instance_group" {
230238
ebs_root_volume_size = 64
231239
ec2_attributes = {
232240
# Instance groups only support one Subnet/AZ
233-
subnet_id = element(module.vpc.private_subnets, 0)
241+
subnet_id = element(module.vpc.private_subnets, 0)
242+
instance_profile = aws_iam_instance_profile.custom_instance_profile.arn
234243
}
244+
iam_instance_profile_role_arn = aws_iam_role.custom_instance_profile.arn
245+
autoscaling_iam_role_arn = aws_iam_role.autoscaling.arn
246+
235247
vpc_id = module.vpc.vpc_id
236248

237249
keep_job_flow_alive_when_no_steps = true
@@ -357,3 +369,70 @@ module "s3_bucket" {
357369

358370
tags = local.tags
359371
}
372+
373+
resource "aws_iam_role" "custom_instance_profile" {
374+
name_prefix = "custom-instance-profile"
375+
assume_role_policy = data.aws_iam_policy_document.assume.json
376+
}
377+
378+
data "aws_iam_policy_document" "assume" {
379+
statement {
380+
actions = ["sts:AssumeRole"]
381+
principals {
382+
identifiers = ["ec2.amazonaws.com"]
383+
type = "Service"
384+
}
385+
}
386+
}
387+
388+
resource "aws_iam_role_policy_attachment" "emr_for_ec2" {
389+
role = aws_iam_role.custom_instance_profile.name
390+
policy_arn = "arn:aws:iam::aws:policy/service-role/AmazonElasticMapReduceforEC2Role"
391+
}
392+
393+
resource "aws_iam_instance_profile" "custom_instance_profile" {
394+
role = aws_iam_role.custom_instance_profile.name
395+
396+
name = "custom-instance-profile"
397+
398+
depends_on = [
399+
aws_iam_role_policy_attachment.emr_for_ec2,
400+
]
401+
}
402+
403+
resource "aws_iam_role" "autoscaling" {
404+
name_prefix = "custom-autoscaling-role"
405+
assume_role_policy = data.aws_iam_policy_document.autoscaling.json
406+
}
407+
408+
data "aws_iam_policy_document" "autoscaling" {
409+
statement {
410+
sid = "EMRAssumeRole"
411+
actions = ["sts:AssumeRole"]
412+
413+
principals {
414+
type = "Service"
415+
identifiers = [
416+
"elasticmapreduce.${data.aws_partition.current.dns_suffix}",
417+
"application-autoscaling.${data.aws_partition.current.dns_suffix}"
418+
]
419+
}
420+
421+
condition {
422+
test = "StringEquals"
423+
variable = "aws:SourceAccount"
424+
values = [data.aws_caller_identity.current.account_id]
425+
}
426+
427+
condition {
428+
test = "ArnLike"
429+
variable = "aws:SourceArn"
430+
values = ["arn:aws:elasticmapreduce:${data.aws_region.current.name}:${data.aws_caller_identity.current.account_id}:*"]
431+
}
432+
}
433+
}
434+
435+
resource "aws_iam_role_policy_attachment" "autoscaling" {
436+
role = aws_iam_role.autoscaling.name
437+
policy_arn = "arn:${data.aws_partition.current.partition}:iam::aws:policy/service-role/AmazonElasticMapReduceforAutoScalingRole"
438+
}

‎examples/private-cluster/versions.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ terraform {
44
required_providers {
55
aws = {
66
source = "hashicorp/aws"
7-
version = ">= 5.59"
7+
version = ">= 5.65"
88
}
99
}
1010
}

‎examples/public-cluster/README.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -26,13 +26,13 @@ Note that this example may create resources which will incur monetary charges on
2626
| Name | Version |
2727
|------|---------|
2828
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.0 |
29-
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 5.59 |
29+
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 5.65 |
3030

3131
## Providers
3232

3333
| Name | Version |
3434
|------|---------|
35-
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 5.59 |
35+
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 5.65 |
3636

3737
## Modules
3838

‎examples/public-cluster/versions.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ terraform {
44
required_providers {
55
aws = {
66
source = "hashicorp/aws"
7-
version = ">= 5.59"
7+
version = ">= 5.65"
88
}
99
}
1010
}

‎examples/serverless-cluster/README.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -26,13 +26,13 @@ Note that this example may create resources which will incur monetary charges on
2626
| Name | Version |
2727
|------|---------|
2828
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.0 |
29-
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 5.59 |
29+
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 5.65 |
3030

3131
## Providers
3232

3333
| Name | Version |
3434
|------|---------|
35-
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 5.59 |
35+
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 5.65 |
3636

3737
## Modules
3838

‎examples/serverless-cluster/versions.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ terraform {
44
required_providers {
55
aws = {
66
source = "hashicorp/aws"
7-
version = ">= 5.59"
7+
version = ">= 5.65"
88
}
99
}
1010
}

‎examples/studio/README.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -22,13 +22,13 @@ $ terraform apply
2222
| Name | Version |
2323
|------|---------|
2424
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.0 |
25-
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 5.59 |
25+
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 5.65 |
2626

2727
## Providers
2828

2929
| Name | Version |
3030
|------|---------|
31-
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 5.59 |
31+
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 5.65 |
3232

3333
## Modules
3434

‎examples/studio/versions.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ terraform {
44
required_providers {
55
aws = {
66
source = "hashicorp/aws"
7-
version = ">= 5.59"
7+
version = ">= 5.65"
88
}
99
}
1010
}

0 commit comments

Comments
 (0)