<p>I'm using this terraform module to create eks cluster: <a href="https://github.com/terraform-aws-modules/terraform-aws-eks" rel="nofollow noreferrer">https://github.com/terraform-aws-modules/terraform-aws-eks</a></p>

<p>Then I create an additional role and added to <code>map_roles</code> input  similar to the <a href="https://github.com/terraform-aws-modules/terraform-aws-eks/blob/master/examples/basic/variables.tf" rel="nofollow noreferrer">example in the repo</a>
(my role is to use CloudWatch)</p>

<pre><code>{
    rolearn  = "arn:aws:iam::66666666666:role/role1"
    username = "role1"
    groups   = ["system:masters"]
}
</code></pre>

<p>I can verify that the role is added to the aws-auth config map together with a role created by the module.</p>

<p>I got this error when the app trying to use CloudWatch: </p>

<blockquote>
  <p>User: arn:aws:sts::xxx:assumed-role/yyy/zzz is not authorized to perform: logs:DescribeLogGroups on resource: arn:aws:logs:xxx:yyy:log-group::log-stream</p>
</blockquote>

<p>the User arn in the error message has the yyy part match the role arn created by the module. So I thought I'm using the wrong role? if so how can I choose the correct credential? (I'm using .NETcore, create <code>AmazonCloudWatchLogsClient</code> without specify any credential)</p>

<p>When I manually edit that role and add the log's permission, the app works. Not sure if it's the right way, if so how can I add the permission in terraforming?</p>

<p>I ended up pulling the <a href="https://github.com/terraform-aws-modules/terraform-aws-eks" rel="nofollow noreferrer">eks module</a> to local and add more policies to the existing role:</p>

<pre><code>resource "aws_iam_policy" "my_new_policy" {
  name_prefix = "eks-worker-my_new_policy-${aws_eks_cluster.this.name}"
  description = "EKS worker node my_new_policy policy for cluster ${aws_eks_cluster.this.name}"
  policy      = data.aws_iam_policy_document.my_new_policy.json
  path        = var.iam_path
}

data "aws_iam_policy_document" "my_new_policy" {
  statement {
    sid    = "my_new_policy"
    effect = "Allow"

    actions = [
      "logs:DescribeLogGroups"
    ]

    resources = ["*"]
  }
}
</code></pre>
