{"id":19767199,"url":"https://github.com/camunda/camunda-tf-eks-module","last_synced_at":"2026-02-04T11:41:33.575Z","repository":{"id":212095831,"uuid":"709796604","full_name":"camunda/camunda-tf-eks-module","owner":"camunda","description":"Terraform modules targeting AWS EKS Cluster creation for Camunda 8 Self-Managed usage on AWS","archived":false,"fork":false,"pushed_at":"2025-04-14T11:17:45.000Z","size":6583,"stargazers_count":2,"open_issues_count":3,"forks_count":0,"subscribers_count":6,"default_branch":"main","last_synced_at":"2025-04-30T15:33:35.238Z","etag":null,"topics":["c8","camunda","eks","team-infrastructure-experience","terraform"],"latest_commit_sha":null,"homepage":"https://docs.camunda.io/docs/self-managed/setup/deploy/amazon/amazon-eks/eks-terraform/","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/camunda.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2023-10-25T12:20:30.000Z","updated_at":"2025-04-14T11:17:47.000Z","dependencies_parsed_at":"2024-05-03T14:23:07.724Z","dependency_job_id":"7e437812-4799-47b8-ba2d-a2a4a25a412c","html_url":"https://github.com/camunda/camunda-tf-eks-module","commit_stats":null,"previous_names":["camunda/camunda-tf-eks-module"],"tags_count":20,"template":false,"template_full_name":null,"purl":"pkg:github/camunda/camunda-tf-eks-module","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/camunda%2Fcamunda-tf-eks-module","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/camunda%2Fcamunda-tf-eks-module/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/camunda%2Fcamunda-tf-eks-module/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/camunda%2Fcamunda-tf-eks-module/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/camunda","download_url":"https://codeload.github.com/camunda/camunda-tf-eks-module/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/camunda%2Fcamunda-tf-eks-module/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":264504616,"owners_count":23618831,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["c8","camunda","eks","team-infrastructure-experience","terraform"],"created_at":"2024-11-12T04:28:20.577Z","updated_at":"2026-02-04T11:41:28.535Z","avatar_url":"https://github.com/camunda.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Camunda Terraform EKS Modules\n\n\u003e [!CAUTION]\n\u003e ⚠️ **Repository Not Maintained Anymore**\n\u003e This repository is no longer actively maintained. All related files have been moved to\n\u003e [**camunda-deployment-references**](https://github.com/camunda/camunda-deployment-references).\n\u003e\n\u003e The decision behind this change is to consolidate all reference implementations into a single repository.\n\u003e This makes it easier for us to maintain and for you as a user to find implementations for different cloud providers.\n\u003e\n\u003e We have not archived this repository yet in case backport changes are needed. However, all active maintenance will\n\u003e be done in the new repository.\n\u003e\n\u003e **Important:** Please do not directly consume the Terraform module sources. Instead, maintain your own copy.\n\n\n[![Camunda](https://img.shields.io/badge/Camunda-FC5D0D)](https://www.camunda.com/)\n[![tests](https://github.com/camunda/camunda-tf-eks-module/actions/workflows/tests.yml/badge.svg?branch=main)](https://github.com/camunda/camunda-tf-eks-module/actions/workflows/tests.yml)\n[![License](https://img.shields.io/github/license/camunda/camunda-tf-eks-module)](LICENSE)\n\nTerraform module which creates AWS EKS (Kubernetes) resources with an opinionated configuration targeting Camunda 8, an AWS Aurora RDS cluster and an OpenSearch domain.\n\n**⚠️ Warning:** This project is not intended for production use but rather for demonstration purposes only. There are no guarantees or warranties provided. As such certain Terraform configuration warnings from Trivy have deliberately been ignored. For more details, see the [.trivyignore](./.trivyignore) file in the repository root.\n\n## Documentation\n\nThe related [guide](https://docs.camunda.io/docs/next/self-managed/setup/deploy/amazon/amazon-eks/eks-terraform/) describes more detailed usage.\nConsider installing Camunda 8 via [this guide](https://docs.camunda.io/docs/next/self-managed/setup/deploy/amazon/amazon-eks/eks-helm/) after deploying the AWS EKS cluster.\n\n## Usage\n\n### Example\n\nBelow is a simple example configuration for deploying both an EKS cluster, an Aurora PostgreSQL database and an OpenSearch domain.\n\nSee [AWS EKS Cluster inputs](./modules/eks-cluster/README.md#inputs), [AWS Aurora RDS inputs](./modules/aurora/README.md#inputs) and [AWS OpenSearch inputs](./modules/opensearch/README.md#inputs) for further configuration options and how they affect the cluster and database creation.\n\n```hcl\nmodule \"eks_cluster\" {\n  source = \"github.com/camunda/camunda-tf-eks-module/modules/eks-cluster\"\n\n  region             = \"eu-central-1\"\n  name               = \"cluster-name\"\n\n  cluster_service_ipv4_cidr = \"10.190.0.0/16\"\n  cluster_node_ipv4_cidr    = \"10.192.0.0/16\"\n}\n```\n\n```hcl\nmodule \"postgresql\" {\n  source                     = \"github.com/camunda/camunda-tf-eks-module/modules/aurora\"\n  engine_version             = \"15.4\"\n  auto_minor_version_upgrade = false\n  cluster_name               = \"cluster-name-postgresql\"\n\n  username         = \"username\"\n  password         = \"password\"\n  vpc_id           = module.eks_cluster.vpc_id\n  subnet_ids       = module.eks_cluster.private_subnet_ids\n  cidr_blocks      = concat(module.eks_cluster.private_vpc_cidr_blocks, module.eks_cluster.public_vpc_cidr_blocks)\n  instance_class   = \"db.t3.medium\"\n  iam_auth_enabled = true\n\n  depends_on = [module.eks_cluster]\n}\n```\n\n```hcl\n\nmodule \"opensearch_domain\" {\n  source = \"github.com/camunda/camunda-tf-eks-module/modules/opensearch\"\n\n  domain_name     = \"my-opensearch-domain\"\n  subnet_ids      = module.eks_cluster.private_subnet_ids\n  vpc_id          = module.eks_cluster.vpc_id\n  cidr_blocks      = concat(module.eks_cluster.private_vpc_cidr_blocks, module.eks_cluster.public_vpc_cidr_blocks)\n\n  instance_type   = \"m7i.large.search\"\n  instance_count  = 3\n  ebs_volume_size = 100\n\n  advanced_security_enabled = true\n  advanced_security_internal_user_database_enabled = true\n  advanced_security_master_user_name = \"admin\"\n  advanced_security_master_user_password = \"password\"\n\n  depends_on = [module.eks_cluster]\n}\n```\n\n#### Deletion Known Issues\n\nDuring the deletion process (`terraform destroy`) of the EKS Cluster, you may encounter an error message related to the `kubernetes_storage_class`:\n\n````\nError: Get \"http://localhost/apis/storage.k8s.io/v1/storageclasses/ebs-sc\": dial tcp [::1]:80: connect: connection refused\n│\n│   with module.eks_cluster.kubernetes_storage_class_v1.ebs_sc,\n│   on .terraform/modules/eks_cluster/modules/eks-cluster/cluster.tf line 156, in resource \"kubernetes_storage_class_v1\" \"ebs_sc\":\n│  156: resource \"kubernetes_storage_class_v1\" \"ebs_sc\" {\n│\n╵\n````\n\nTo resolve this issue, you can set the variable `create_ebs_gp3_default_storage_class` to `false`, which skips the creation of the `kubernetes_storage_class` resource. This helps to avoid dependency issues during deletion. Run the following command:\n\n```bash\nterraform destroy -var=\"create_ebs_gp3_default_storage_class=false\"\n```\n\nIf you still encounter the issue, you may need to manually remove the state for the storage class:\n\n```bash\nterraform state rm module.eks_cluster.kubernetes_storage_class_v1.ebs_sc\n```\n\nAfter performing these steps, re-run `terraform destroy` to complete the deletion process without further interruptions.\n\n#### GitHub Actions\n\nYou can automate the deployment and deletion of the EKS cluster and Aurora database using GitHub Actions.\n\n**Note:** This is recommended only for development and testing purposes, not for production use.\n\nBelow are examples of GitHub Actions workflows for deploying and deleting these resources.\n\nFor more details, refer to the corresponding [EKS Actions README](./.github/actions/eks-manage-cluster/README.md), [Aurora Actions README](./.github/actions/aurora-manage-cluster/README.md) and [OpenSearch Actions README](./.github/actions/opensearch-manage-cluster/README.md), [Cleanup Actions README](./.github/actions/eks-cleanup-resources/README.md).\n\nAn example workflow can be found in [here](./.github/workflows/test-gha-eks.yml).\n\n#### Advanced usage with IRSA\n\nThis documentation provides a step-by-step guide to creating an EKS cluster, an Aurora RDS instance, and an OpenSearch domain with IRSA (IAM Roles for Service Accounts) roles using Terraform modules. The modules create the necessary IAM roles and policies for Aurora and OpenSearch. To simplify the configuration, the modules use the outputs of the EKS cluster module to define the IRSA roles and policies.\n\nFor further details and a more in-depth configuration, it is recommended to refer to the official documentation at:\n- [Amazon EKS Terraform setup](https://docs.camunda.io/docs/self-managed/setup/deploy/amazon/amazon-eks/eks-terraform/)\n- [IRSA roles setup](https://docs.camunda.io/docs/self-managed/setup/deploy/amazon/amazon-eks/irsa/)\n\n\n### Aurora IRSA Role and Policy\n\nThe Aurora module uses the following outputs from the EKS cluster module to define the IRSA role and policy:\n\n- `module.eks_cluster.oidc_provider_arn`: The ARN of the OIDC provider for the EKS cluster.\n- `module.eks_cluster.oidc_provider_id`: The ID of the OIDC provider for the EKS cluster.\n- `var.account_id`: Your AWS account id\n- `var.aurora_region`: Your Aurora AWS Region\n- `var.aurora_irsa_username`: The username used to access AuroraDB. This username is different from the superuser. The user must also be created manually in the database to enable the IRSA connection, as described in [the steps below](#create-irsa-user-on-the-database).\n- `var.aurora_namespace`: The kubernetes namespace to allow access\n- `var.aurora_service_account`: The kubernetes ServiceAccount to allow access\n\nYou need to define the IAM role trust policy and access policy for Aurora. Here's an example of how to define these policies using the outputs of the EKS cluster module:\n\n```hcl\nmodule \"postgresql\" {\n  # ...\n  iam_roles_with_policies = [\n    {\n      role_name = \"AuroraRole-your-cluster\" # ensure uniqueness of this one\n\n      # Source: https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.IAMDBAuth.IAMPolicy.html\n      # Since the DbiResourceId may be unknown during the apply process, and because each instance of the RDS cluster contains its own DbiResourceId,\n      # we use the wildcard `dbuser:*` to apply to all database instances.\n\n      access_policy = \u003c\u003cEOF\n            {\n              \"Version\": \"2012-10-17\",\n              \"Statement\": [\n                {\n                  \"Effect\": \"Allow\",\n                  \"Action\": [\n                    \"rds-db:connect\"\n                  ],\n                  \"Resource\": \"arn:aws:rds-db:${var.aurora_region}:${var.account_id}:dbuser:*/${var.aurora_irsa_username}\"\n                }\n              ]\n            }\nEOF\n\n      trust_policy = \u003c\u003cEOF\n          {\n            \"Version\": \"2012-10-17\",\n            \"Statement\": [\n              {\n                \"Effect\": \"Allow\",\n                \"Principal\": {\n                  \"Federated\": \"${module.eks_cluster.oidc_provider_arn}\"\n                },\n                \"Action\": \"sts:AssumeRoleWithWebIdentity\",\n                \"Condition\": {\n                  \"StringEquals\": {\n                    \"${module.eks_cluster.oidc_provider_id}:sub\": \"system:serviceaccount:${var.aurora_namespace}:${var.aurora_service_account}\"\n                  }\n                }\n              }\n            ]\n          }\nEOF\n    }\n  ]\n\n  iam_auth_enabled = true\n  # ...\n}\n```\n\n#### Create IRSA User on the Database\n\nOnce the database is up, you will need to connect to it using the superuser credentials defined in the module (`username`, `password`).\n\n```bash\necho \"Creating IRSA DB user using admin user\"\npsql -h $AURORA_ENDPOINT -p $AURORA_PORT \"sslmode=require dbname=$AURORA_DB_NAME user=$AURORA_USERNAME password=$AURORA_PASSWORD\" \\\n  -c \"CREATE USER \\\"${AURORA_USERNAME_IRSA}\\\" WITH LOGIN;\" \\\n  -c \"GRANT rds_iam TO \\\"${AURORA_USERNAME_IRSA}\\\";\" \\\n  -c \"GRANT ALL PRIVILEGES ON DATABASE \\\"${AURORA_DB_NAME}\\\" TO \\\"${AURORA_USERNAME_IRSA}\\\";\" \\\n  -c \"SELECT aurora_version();\" \\\n  -c \"SELECT version();\" -c \"\\du\"\n```\n\nThe permissions can be adapted as needed. However, the most important permission is `rds_iam`, which is required for using IRSA with the database.\n\nA complete example of a pod to [create the database is available](modules/fixtures/postgres-client.yml).\n\n### OpenSearch IRSA Role and Policy\n\nThe OpenSearch module uses the following outputs from the EKS cluster module to define the IRSA role and policy:\n\n- `module.eks_cluster.oidc_provider_arn`: The ARN of the OIDC provider for the EKS cluster.\n- `module.eks_cluster.oidc_provider_id`: The ID of the OIDC provider for the EKS cluster.\n- `var.account_id`: Your AWS account id\n- `var.opensearch_region`: Your OpenSearch AWS Region\n- `var.opensearch_domain_name`: The name of the OpenSearch domain to access\n- `var.opensearch_namespace`: The kubernetes namespace to allow access\n- `var.opensearch_service_account`: The kubernetes ServiceAccount to allow access\n\n```hcl\nmodule \"opensearch_domain\" {\n  # ...\n  iam_roles_with_policies = [\n    {\n      role_name = \"OpenSearchRole-your-cluster\" # ensure uniqueness of this one\n      access_policy =\u003c\u003cEOF\n            {\n              \"Version\": \"2012-10-17\",\n              \"Statement\": [\n                {\n                  \"Effect\": \"Allow\",\n                  \"Action\": [\n                    \"es:ESHttpGet\",\n                    \"es:ESHttpPut\",\n                    \"es:ESHttpPost\"\n                  ],\n                  \"Resource\": \"arn:aws:es:${var.opensearch_region}:${var.account_id}:domain/${var.opensearch_domain_name}/*\"\n                }\n              ]\n            }\nEOF\n\n      trust_policy =  \u003c\u003cEOF\n          {\n            \"Version\": \"2012-10-17\",\n            \"Statement\": [\n              {\n                \"Effect\": \"Allow\",\n                \"Principal\": {\n                  \"Federated\": \"${module.eks_cluster.oidc_provider_arn}\"\n                },\n                \"Action\": \"sts:AssumeRoleWithWebIdentity\",\n                \"Condition\": {\n                  \"StringEquals\": {\n                    \"${module.eks_cluster.oidc_provider_id}:sub\": \"system:serviceaccount:${var.opensearch_namespace}:${var.opensearch_service_account}\"\n                  }\n                }\n              }\n            ]\n          }\nEOF\n    }\n  ]\n\n  # ...\n}\n```\n\nBy defining the IRSA roles and policies using the outputs of the EKS cluster module, you can simplify the configuration and ensure that the roles and policies are created with the correct permissions and trust policies.\n\nApply the Service Accounts definitions to your Kubernetes cluster:\n\n**Aurora Service Account**\n\n```yaml\napiVersion: v1\nkind: ServiceAccount\nmetadata:\n  name: aurora-service-account\n  namespace: \u003cyour-namespace\u003e\n  annotations:\n    eks.amazonaws.com/role-arn: \u003carn:aws:iam:\u003cYOUR-ACCOUNT-ID\u003e:role/AuroraRole\u003e\n```\nYou can retrieve the role ARN from the module output: `aurora_iam_role_arns['Aurora-your-cluster']`.\n\n**OpenSearch Service Account**\n\n```yaml\napiVersion: v1\nkind: ServiceAccount\nmetadata:\n  name: opensearch-service-account\n  namespace: \u003cyour-namespace\u003e\n  annotations:\n    eks.amazonaws.com/role-arn: \u003carn:aws:iam:\u003cYOUR-ACCOUNT-ID\u003e:role/OpenSearchRole\u003e\n```\nYou can retrieve the role ARN from the module output: `opensearch_iam_role_arns['OpenSearch-your-cluster']`.\n\n## Support\n\nPlease note that the modules have been tested with **[Terraform](https://github.com/hashicorp/terraform)** in the version described in the [.tool-versions](./.tool-versions) of this project.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcamunda%2Fcamunda-tf-eks-module","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fcamunda%2Fcamunda-tf-eks-module","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcamunda%2Fcamunda-tf-eks-module/lists"}