<p>I want to set up a EKS cluster, enabling other IAM users to connect and tinker with the cluster. To do so, <a href="https://docs.aws.amazon.com/eks/latest/userguide/add-user-role.html" rel="nofollow noreferrer">AWS recommends patching a config map</a>, which I did. Now I want to enable the same “feature” using terraform.</p>
<p>I use terraforms EKS provider and read <a href="https://registry.terraform.io/modules/terraform-aws-modules/eks/aws/latest#general-notes" rel="nofollow noreferrer">in the documentation</a> in section &quot;Due to the plethora of tooling a...&quot; that basically authentication is up to myself.</p>
<p>Now I use the <a href="https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs" rel="nofollow noreferrer">Terraform Kubernetes provider</a> to update this config map:</p>
<pre><code>resource &quot;kubernetes_config_map&quot; &quot;aws_auth&quot; {
  depends_on = [module.eks.cluster_id]
  metadata {
    name      = &quot;aws-auth&quot;
    namespace = &quot;kube-system&quot;
  }

  data = THATS_MY_UPDATED_CONFIG
}
</code></pre>
<p>But do not succeed and get the following error:</p>
<pre><code>2022-01-07T15:49:55.732+0100 [DEBUG] provider.terraform-provider-kubernetes_v2.7.1_x5: 2022/01/07 15:49:55 [DEBUG] Kubernetes API Response Details:
2022-01-07T15:49:55.732+0100 [DEBUG] provider.terraform-provider-kubernetes_v2.7.1_x5: ---[ RESPONSE ]--------------------------------------
2022-01-07T15:49:55.732+0100 [DEBUG] provider.terraform-provider-kubernetes_v2.7.1_x5: HTTP/2.0 409 Conflict
2022-01-07T15:49:55.732+0100 [DEBUG] provider.terraform-provider-kubernetes_v2.7.1_x5: Content-Length: 206
2022-01-07T15:49:55.732+0100 [DEBUG] provider.terraform-provider-kubernetes_v2.7.1_x5: Audit-Id: 15....
2022-01-07T15:49:55.732+0100 [DEBUG] provider.terraform-provider-kubernetes_v2.7.1_x5: Cache-Control: no-cache, private
2022-01-07T15:49:55.732+0100 [DEBUG] provider.terraform-provider-kubernetes_v2.7.1_x5: Content-Type: application/json
2022-01-07T15:49:55.732+0100 [DEBUG] provider.terraform-provider-kubernetes_v2.7.1_x5: Date: Fri, 07 Jan 2022 14:49:55 GMT
2022-01-07T15:49:55.732+0100 [DEBUG] provider.terraform-provider-kubernetes_v2.7.1_x5: X-Kubernetes-Pf-Flowschema-Uid: f43...
2022-01-07T15:49:55.732+0100 [DEBUG] provider.terraform-provider-kubernetes_v2.7.1_x5: X-Kubernetes-Pf-Prioritylevel-Uid: 0054...
2022-01-07T15:49:55.732+0100 [DEBUG] provider.terraform-provider-kubernetes_v2.7.1_x5:
2022-01-07T15:49:55.732+0100 [DEBUG] provider.terraform-provider-kubernetes_v2.7.1_x5: {
2022-01-07T15:49:55.732+0100 [DEBUG] provider.terraform-provider-kubernetes_v2.7.1_x5:  &quot;kind&quot;: &quot;Status&quot;,
2022-01-07T15:49:55.732+0100 [DEBUG] provider.terraform-provider-kubernetes_v2.7.1_x5:  &quot;apiVersion&quot;: &quot;v1&quot;,
2022-01-07T15:49:55.732+0100 [DEBUG] provider.terraform-provider-kubernetes_v2.7.1_x5:  &quot;metadata&quot;: {},
2022-01-07T15:49:55.732+0100 [DEBUG] provider.terraform-provider-kubernetes_v2.7.1_x5:  &quot;status&quot;: &quot;Failure&quot;,
2022-01-07T15:49:55.732+0100 [DEBUG] provider.terraform-provider-kubernetes_v2.7.1_x5:  &quot;message&quot;: &quot;configmaps \&quot;aws-auth\&quot; already exists&quot;,
2022-01-07T15:49:55.733+0100 [DEBUG] provider.terraform-provider-kubernetes_v2.7.1_x5:  &quot;reason&quot;: &quot;AlreadyExists&quot;,
2022-01-07T15:49:55.733+0100 [DEBUG] provider.terraform-provider-kubernetes_v2.7.1_x5:  &quot;details&quot;: {
2022-01-07T15:49:55.733+0100 [DEBUG] provider.terraform-provider-kubernetes_v2.7.1_x5:   &quot;name&quot;: &quot;aws-auth&quot;,
2022-01-07T15:49:55.733+0100 [DEBUG] provider.terraform-provider-kubernetes_v2.7.1_x5:   &quot;kind&quot;: &quot;configmaps&quot;
2022-01-07T15:49:55.733+0100 [DEBUG] provider.terraform-provider-kubernetes_v2.7.1_x5:  },
2022-01-07T15:49:55.733+0100 [DEBUG] provider.terraform-provider-kubernetes_v2.7.1_x5:  &quot;code&quot;: 409
2022-01-07T15:49:55.733+0100 [DEBUG] provider.terraform-provider-kubernetes_v2.7.1_x5: }
2022-01-07T15:49:55.733+0100 [DEBUG] provider.terraform-provider-kubernetes_v2.7.1_x5:
2022-01-07T15:49:55.733+0100 [DEBUG] provider.terraform-provider-kubernetes_v2.7.1_x5: -----------------------------------------------------
2022-01-07T15:49:55.775+0100 [ERROR] vertex &quot;module.main.module.eks.kubernetes_config_map.aws_auth&quot; error: configmaps &quot;aws-auth&quot; already exists
╷
│ Error: configmaps &quot;aws-auth&quot; already exists
│
│   with module.main.module.eks.kubernetes_config_map.aws_auth,
│   on ../../modules/eks/eks-iam-map-users.tf line 44, in resource &quot;kubernetes_config_map&quot; &quot;aws_auth&quot;:
│   44: resource &quot;kubernetes_config_map&quot; &quot;aws_auth&quot; {
│
╵
</code></pre>
<p>It seems this is a controversial problem and as everyone using EKS and Terraform should have it – I ask myself how to solve this? The <a href="https://github.com/terraform-aws-modules/terraform-aws-eks/issues/852" rel="nofollow noreferrer">related issue</a>, <a href="https://stackoverflow.com/questions/51127339/terraform-kubernetes-provider-with-eks-fails-on-configmap">I</a> is close .... I'm somewhat lost, anyone has an idea?</p>
<p>I use the following versions:</p>
<pre><code>terraform {
  required_providers {
    # https://registry.terraform.io/providers/hashicorp/aws/latest
    aws = {
      source  = &quot;hashicorp/aws&quot;
      version = &quot;~&gt; 3.70&quot;
    }

    # https://registry.terraform.io/providers/hashicorp/kubernetes/latest
    kubernetes = {
      source  = &quot;hashicorp/kubernetes&quot;
      version = &quot;~&gt; 2.7.1&quot;
    }

  required_version = &quot;&gt;= 1.1.2&quot;
}

...
module &quot;eks&quot; {
  source  = &quot;terraform-aws-modules/eks/aws&quot;
  version = &quot;18.0.3&quot;
...
</code></pre>

<p>I use 17.24.0 and have no idea what is new with 18.0.3.</p>
<p>In my case, I follow this example:
<a href="https://github.com/terraform-aws-modules/terraform-aws-eks/blob/v17.24.0/examples/complete/main.tf" rel="nofollow noreferrer">https://github.com/terraform-aws-modules/terraform-aws-eks/blob/v17.24.0/examples/complete/main.tf</a></p>
<p>My main.tf</p>
<pre><code>locals {
  eks_map_roles       = []
  eks_map_users       = []
}

data &quot;aws_eks_cluster&quot; &quot;cluster&quot; {
  name = module.eks.cluster_id
}

data &quot;aws_eks_cluster_auth&quot; &quot;cluster&quot; {
  name = module.eks.cluster_id
}

provider &quot;kubernetes&quot; {
  host                   = data.aws_eks_cluster.cluster.endpoint
  cluster_ca_certificate = base64decode(data.aws_eks_cluster.cluster.certificate_authority[0].data)
  token                  = data.aws_eks_cluster_auth.cluster.token
}

module &quot;eks&quot; {
  source = &quot;...&quot;
  ...
  eks_map_roles       = local.eks_map_roles
  eks_map_users       = local.eks_map_users
  ...
}
</code></pre>
<p>To add another user, you can follow this docs: <a href="https://aws.amazon.com/premiumsupport/knowledge-center/eks-api-server-unauthorized-error/" rel="nofollow noreferrer">https://aws.amazon.com/premiumsupport/knowledge-center/eks-api-server-unauthorized-error/</a></p>
<p>I think you should add the role (don't forget to remove the path).</p>
