Created an AWS user for each namespace for Deployment

k8s/aws/namespace/main.tf

@@ -13,18 +13,24 @@ resource "kubernetes_namespace" "app_environments" {
 
 resource "aws_iam_policy" "service_policy" {
   name        = "${local.cluster_name}-${var.namespace}-service-policy"
-  description = "Allows IAM users to access EKS cluster and ECR repositories"
-  policy      = jsonencode({
+  description = "Allows IAM users to access EKS namespaces and ECR repositories"
+
+  policy = jsonencode({
     Version = "2012-10-17"
     Statement = [
       {
         Effect   = "Allow"
         Action   = [
           "eks:ListClusters",
           "eks:DescribeCluster",
-          "eks:AccessKubernetesAPI"
-        ]
-        Resource = "*"
+          "eks:AccessKubernetesApi"
+        ],
+        Resource = "arn:aws:eks:${var.app_region}:${data.aws_caller_identity.current.account_id}:cluster/${local.cluster_name}",
+        Condition = {
+          StringEquals = {
+            "eks:ResourceTag/Namespace" = var.namespace
+          }
+        }
       },
       {
         "Sid": "ECRUploadAccess",
@@ -45,12 +51,25 @@ resource "aws_iam_policy" "service_policy" {
   })
 }
 
+data "aws_caller_identity" "current" {}
+
+resource "aws_iam_user" "namespace_users" {
+  for_each = var.services
+  name     = "${each.value.service_deployer}-${var.namespace}-user"
+}
+
 resource "aws_iam_user_policy_attachment" "service_policy_attachment" {
   for_each = var.services
   user = each.value.service_deployer
   policy_arn = aws_iam_policy.service_policy.arn
 }
 
+resource "aws_iam_user_policy_attachment" "namespace_user_policy" {
+  for_each   = var.services
+  user       = aws_iam_user.namespace_users[each.key].name
+  policy_arn = aws_iam_policy.service_policy.arn
+}
+
 resource "aws_iam_access_key" "user_credentials" {
   for_each = var.services
   user = each.value.service_deployer
@@ -61,6 +80,11 @@ resource "aws_secretsmanager_secret" "access_key_id" {
   name = "${var.namespace}_${each.value.service_deployer}_ACCESS_KEY_ID"
 }
 
+resource "aws_iam_access_key" "namespace_user_keys" {
+  for_each = var.services
+  user     = aws_iam_user.namespace_users[each.key].name
+}
+
 resource "aws_secretsmanager_secret_version" "access_key_id_version" {
   for_each = var.services
   secret_id     = aws_secretsmanager_secret.access_key_id[each.key].id

k8s/aws/namespace/outputs.tf

@@ -95,3 +95,15 @@ output "custom_secrets_name_list" {
   })
 }
 
+
+output "namespace_user_access_keys" {
+  description = "AWS access keys for namespace users"
+  value = tomap({
+    for service, user in aws_iam_user.namespace_users :
+    "${service}-${var.namespace}-user" => {
+      access_key_id     = aws_iam_access_key.namespace_user_keys[service].id
+      secret_access_key = aws_iam_access_key.namespace_user_keys[service].secret
+    }
+  })
+  sensitive = true
+}