Feasibility to add additional trust policy on worker nodes

iam.tf

@@ -37,7 +37,7 @@ resource "aws_iam_role" "workers" {
   name        = coalesce(var.workers_iam_role, "${var.cluster_name}-workers")
   description = "IAM Role for the workers in EKS Cluster named ${var.cluster_name}"
 
-  assume_role_policy    = data.aws_iam_policy_document.ec2_assume_role_policy.json
+  assume_role_policy    = data.aws_iam_policy_document.combined_assume_policy.json
   permissions_boundary  = var.workers_iam_boundary
   force_detach_policies = true
 

policies.tf

@@ -1,3 +1,10 @@
+locals {
+  source_policy_documents = length(var.workers_additional_assume_policy) > 0 ? [
+    data.aws_iam_policy_document.ec2_assume_role_policy.json,
+    data.aws_iam_policy_document.workers_additional_assume_policy.json
+  ] : [data.aws_iam_policy_document.ec2_assume_role_policy.json]
+}
+
 data "aws_iam_policy_document" "eks_assume_role_policy" {
   statement {
     sid     = "EKSClusterAssumeRole"
@@ -22,6 +29,15 @@ data "aws_iam_policy_document" "ec2_assume_role_policy" {
   }
 }
 
+data "aws_iam_policy_document" "workers_additional_assume_policy" {
+  # Decode the JSON policy
+  source_policy_documents = [var.workers_additional_assume_policy]
+}
+
+data "aws_iam_policy_document" "combined_assume_policy" {
+  source_policy_documents = local.source_policy_documents
+}
+
 # This policy is required for the KMS key used for EKS root volumes, so the cluster is allowed to enc/dec/attach encrypted EBS volumes
 data "aws_iam_policy_document" "kms_ebs" {
   # Required for EKS

variables.tf

@@ -54,6 +54,12 @@ variable "iam_role_additional_policies" {
   default     = []
 }
 
+variable "workers_additional_assume_policy" {
+  description = "Additional Worker role Assume Policy JSON document"
+  type        = string
+  default     = ""
+}
+
 #######################
 # Cluster RBAC (AWS Auth)
 #######################