fix: Use dynamic partition data source to determine DNS suffix for Ka…

…rpenter EC2 pass role permission (#3193) * fix karpenter iam passrole to ec2 api bug, to support aws cn * fix: Use dyanmic partition value for DNS suffix --------- Co-authored-by: Shuiping <[email protected]> Co-authored-by: Bryant Biggs <[email protected]>
terraform-aws-modules · Oct 27, 2024 · dea6c44 · dea6c44
1 parent 4abc779
commit dea6c44
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/modules/karpenter/policy.tf b/modules/karpenter/policy.tf
@@ -195,7 +195,7 @@ data "aws_iam_policy_document" "v033" {
     condition {
       test     = "StringEquals"
       variable = "iam:PassedToService"
-      values   = ["ec2.amazonaws.com"]
+      values   = ["ec2.${local.dns_suffix}"]
     }
   }
 
@@ -584,7 +584,7 @@ data "aws_iam_policy_document" "v1" {
     condition {
       test     = "StringEquals"
       variable = "iam:PassedToService"
-      values   = ["ec2.amazonaws.com"]
+      values   = ["ec2.${local.dns_suffix}"]
     }
   }