aws_eks_cluster.this:创建EKS集群的错误(test-eks)：InvalidParameterException:角色参数中的错误状态代码: 400

Question

我对从这个社区terraform模块中提供的示例中部署一个测试环境有问题。

由于角色参数无效，群集创建失败。

...
module.eks.aws_eks_cluster.this: Creating...
  arn:                                        "" => "<computed>"
  certificate_authority.#:                    "" => "<computed>"
  created_at:                                 "" => "<computed>"
  endpoint:                                   "" => "<computed>"
  name:                                       "" => "test-eks-lWuwSgqK"
  platform_version:                           "" => "<computed>"
  role_arn:                                   "" => "arn:aws:iam::388030365049:role/test-eks-lWuwSgqK20181120125058962600000001"
  version:                                    "" => "1.10"
  vpc_config.#:                               "" => "1"
  vpc_config.0.security_group_ids.#:          "" => "1"
  vpc_config.0.security_group_ids.3345499915: "" => "sg-0440b523195e2b0ab"
  vpc_config.0.subnet_ids.#:                  "" => "3"
  vpc_config.0.subnet_ids.1248930552:         "" => "subnet-0726008335a5d88d5"
  vpc_config.0.subnet_ids.2473547375:         "" => "subnet-0fc6f4d85a453dbd5"
  vpc_config.0.subnet_ids.3955092080:         "" => "subnet-08c3c49b6442780ec"
  vpc_config.0.vpc_id:                        "" => "<computed>"
....
Error: Error applying plan:

1 error(s) occurred:

* module.eks.aws_eks_cluster.this: 1 error(s) occurred:

* aws_eks_cluster.this: error creating EKS Cluster (test-eks-lWuwSgqK): InvalidParameterException: Error in role params
    status code: 400, request id: f57ed2d0-ecc2-11e8-9fa6-b5608af2307c

使用eks_test_fixture：fixture

环境详细信息

受影响模块版本: 1.7.0。

操作系统: MacOS Mojave 10.14.1

Terraform版本: 0.11.10

提前感谢！

Answer 1

我不得不重新配置IAM角色、用户和策略。

示例：

module "xxxxx" {
  source                               = "git@github.com:terraform-aws-modules/terraform-aws-eks.git?ref=v1.7.0"
  cluster_name                         = "xxxx-xxxx"
  subnets                              = ["${module.vpc1.private_subnets}"]
  vpc_id                               = "${module.vpc1.vpc_id}"
  map_roles                            = "${local.eks_map_roles}"
...
}

locals {
  eks_map_roles = [
    {
      role_arn = "arn:aws:iam::${data.aws_caller_identity.current.account_id}:role/xxxxx"
      username = "admin:{{SessionName}}"
      group    = "system:masters"
    },
    {
      role_arn = "arn:aws:iam::${data.aws_caller_identity.current.account_id}:role/xxxxxxx"
      username = "admin:{{SessionName}}"
      group    = "system:masters"
    },
  ]
}