terraform - aws_eks_cluster.this：创建 EKS 集群时出错（test-eks-lWuwSgqK）：InvalidParameterException：角色参数状态代码错误：400

Question

我在从这个社区 terraform-aws-eks 模块中提供的示例部署测试环境时遇到问题。

由于角色参数无效，集群创建失败。

...
module.eks.aws_eks_cluster.this: Creating...
  arn:                                        "" => "<computed>"
  certificate_authority.#:                    "" => "<computed>"
  created_at:                                 "" => "<computed>"
  endpoint:                                   "" => "<computed>"
  name:                                       "" => "test-eks-lWuwSgqK"
  platform_version:                           "" => "<computed>"
  role_arn:                                   "" => "arn:aws:iam::388030365049:role/test-eks-lWuwSgqK20181120125058962600000001"
  version:                                    "" => "1.10"
  vpc_config.#:                               "" => "1"
  vpc_config.0.security_group_ids.#:          "" => "1"
  vpc_config.0.security_group_ids.3345499915: "" => "sg-0440b523195e2b0ab"
  vpc_config.0.subnet_ids.#:                  "" => "3"
  vpc_config.0.subnet_ids.1248930552:         "" => "subnet-0726008335a5d88d5"
  vpc_config.0.subnet_ids.2473547375:         "" => "subnet-0fc6f4d85a453dbd5"
  vpc_config.0.subnet_ids.3955092080:         "" => "subnet-08c3c49b6442780ec"
  vpc_config.0.vpc_id:                        "" => "<computed>"
....
Error: Error applying plan:

1 error(s) occurred:

* module.eks.aws_eks_cluster.this: 1 error(s) occurred:

* aws_eks_cluster.this: error creating EKS Cluster (test-eks-lWuwSgqK): InvalidParameterException: Error in role params
    status code: 400, request id: f57ed2d0-ecc2-11e8-9fa6-b5608af2307c

使用 eks_test_fixture： https ://github.com/terraform-aws-modules/terraform-aws-eks/tree/master/examples/eks_test_fixture

环境细节

受影响的模块版本：1.7.0。

操作系统：MacOS Mojave 10.14.1

地形版本：0.11.10

提前致谢！

Answer 1

我不得不重新配置 IAM 角色、用户和策略。

例子：

module "xxxxx" {
  source                               = "git@github.com:terraform-aws-modules/terraform-aws-eks.git?ref=v1.7.0"
  cluster_name                         = "xxxx-xxxx"
  subnets                              = ["${module.vpc1.private_subnets}"]
  vpc_id                               = "${module.vpc1.vpc_id}"
  map_roles                            = "${local.eks_map_roles}"
...
}

locals {
  eks_map_roles = [
    {
      role_arn = "arn:aws:iam::${data.aws_caller_identity.current.account_id}:role/xxxxx"
      username = "admin:{{SessionName}}"
      group    = "system:masters"
    },
    {
      role_arn = "arn:aws:iam::${data.aws_caller_identity.current.account_id}:role/xxxxxxx"
      username = "admin:{{SessionName}}"
      group    = "system:masters"
    },
  ]
}