IAM Role Mapping on EKS

Question

I am working on IaC EKS using terraform.
[https://www.ahead.com/resources/automate-iam-role-mapping-on-amazon-eks]()
I receive below error.
Error: creating IAM Role (eks_admin): MalformedPolicyDocument: Invalid principal in policy: "AWS":"arn:aws:iam::xxxxxxxxxxx:user/eks-test-usr"
status code: 400

```
resource "aws_iam_role" "eks_admin" {
  name = "eks_admin"

assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action = "sts:AssumeRole"
        Effect = "Allow"
        Sid    = ""
        Principal: { "AWS" : "${var.assume_role}" }
      },
    ]
  })

inline_policy {
    name = "eks_admin_policy"

policy = jsonencode({
      Version = "2012-10-17"
      Statement = [
        {
          Action   = ["eks:DescribeCluster"]
          Effect   = "Allow"
          Resource = "*"
        },
      ]
    })
  }
}

I pass the variable as 
assum_role=["eks-test-dev","eks-test-admin"]
```

Answer

Hello rePost-User-9219791,

You are facing this issue because your terraform variable `assume_role` is a list of role names.

The Principal property of the IAM policy only allows role ARNs as valid principals. Therefore, pass the list of role ARNs instead of role names as shown below.

```
assume_role=["arn:aws:iam:::role/eks-test-dev","arn:aws:iam:::role/eks-test-admin"]
```

Also make sure that the above roles exist in your AWS account before creating the IAM role resource using terraform.

I hope this helps!

IAM Role Mapping on EKS

Relevant content