ENH: add AWS IAM permissions_boundary option #2078 (#2082)

Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>

src/_nebari/stages/infrastructure/__init__.py

@@ -128,6 +128,7 @@ class AWSNodeGroupInputVars(schema.Base):
     desired_size: int
     max_size: int
     single_subnet: bool
+    permissions_boundary: Optional[str] = None
 
 
 class AWSInputVars(schema.Base):
@@ -140,6 +141,7 @@ class AWSInputVars(schema.Base):
     node_groups: List[AWSNodeGroupInputVars]
     availability_zones: List[str]
     vpc_cidr_block: str
+    permissions_boundary: Optional[str] = None
     kubeconfig_filename: str = get_kubeconfig_filename()
 
 
@@ -432,6 +434,7 @@ class AWSNodeGroup(schema.Base):
     max_nodes: int
     gpu: bool = False
     single_subnet: bool = False
+    permissions_boundary: Optional[str] = None
 
 
 class AmazonWebServicesProvider(schema.Base):
@@ -450,6 +453,7 @@ class AmazonWebServicesProvider(schema.Base):
     existing_subnet_ids: typing.List[str] = None
     existing_security_group_ids: str = None
     vpc_cidr_block: str = "10.10.0.0/16"
+    permissions_boundary: Optional[str] = None
 
     @pydantic.root_validator
     def validate_all(cls, values):
@@ -768,11 +772,13 @@ def input_vars(self, stage_outputs: Dict[str, Dict[str, Any]]):
                         desired_size=node_group.min_nodes,
                         max_size=node_group.max_nodes,
                         single_subnet=node_group.single_subnet,
+                        permissions_boundary=node_group.permissions_boundary,
                     )
                     for name, node_group in self.config.amazon_web_services.node_groups.items()
                 ],
                 availability_zones=self.config.amazon_web_services.availability_zones,
                 vpc_cidr_block=self.config.amazon_web_services.vpc_cidr_block,
+                permissions_boundary=self.config.amazon_web_services.permissions_boundary,
             ).dict()
         else:
             raise ValueError(f"Unknown provider: {self.config.provider}")

src/_nebari/stages/infrastructure/template/aws/modules/kubernetes/policy.tf

@@ -21,8 +21,8 @@ resource "aws_iam_role" "cluster" {
     }]
     Version = "2012-10-17"
   })
-
-  tags = var.tags
+  permissions_boundary = var.permissions_boundary
+  tags                 = var.tags
 }
 
 resource "aws_iam_role_policy_attachment" "cluster-policy" {
@@ -50,8 +50,8 @@ resource "aws_iam_role" "node-group" {
     }]
     Version = "2012-10-17"
   })
-
-  tags = var.tags
+  permissions_boundary = var.permissions_boundary
+  tags                 = var.tags
 }
 
 resource "aws_iam_role_policy_attachment" "node-group-policy" {

src/_nebari/stages/infrastructure/template/aws/modules/kubernetes/variables.tf

@@ -69,3 +69,9 @@ variable "public_access_cidrs" {
   type    = list(string)
   default = ["0.0.0.0/0"]
 }
+
+variable "permissions_boundary" {
+  description = "ARN of the policy that is used to set the permissions boundary for the role"
+  type        = string
+  default     = null
+}

src/_nebari/stages/infrastructure/template/aws/variables.tf

@@ -65,3 +65,9 @@ variable "eks_public_access_cidrs" {
   type    = list(string)
   default = ["0.0.0.0/0"]
 }
+
+variable "permissions_boundary" {
+  description = "ARN of the policy that is used to set the permissions boundary for the role"
+  type        = string
+  default     = null
+}

tests/tests_unit/test_schema.py

@@ -139,6 +139,22 @@ def test_multiple_providers(config_schema):
         config_schema(**config_dict)
 
 
+def test_aws_premissions_boundary(config_schema):
+    permissions_boundary = "arn:aws:iam::123456789012:policy/MyBoundaryPolicy"
+    config_dict = {
+        "project_name": "test",
+        "provider": "aws",
+        "amazon_web_services": {
+            "region": "us-east-1",
+            "kubernetes_version": "1.19",
+            "permissions_boundary": f"{permissions_boundary}",
+        },
+    }
+    config = config_schema(**config_dict)
+    assert config.provider == "aws"
+    assert config.amazon_web_services.permissions_boundary == permissions_boundary
+
+
 @pytest.mark.parametrize("provider", ["local", "existing"])
 def test_setted_provider(config_schema, provider):
     config_dict = {