<p>Had an issue recently using the <code>terraform-aws-eks</code> module where we wanted to create the <code>aws-auth</code> config map and set the <code>mapRoles</code> and <code>mapAccounts</code> fields in the module but manage the <code>mapUsers</code> elsewhere.</p>
<p><code>kubernetes_config_map_v1_data</code> seemed tailor made for this but we kept running into conflict issues where the fields created by <code>kubernetes_config_map_v1_data</code> kept wanting to get destroyed by the <code>kubernetes_config_map</code> resource.</p>
<p>We found a solution and put the answer below to anybody else having this issue.</p>

<p>terraform-aws-eks module version <code>17</code></p>
<p>within the terraform module <code>aws-auth.tf</code>:</p>
<pre><code>resource &quot;kubernetes_config_map&quot; &quot;aws_auth&quot; {
  count = var.create_eks &amp;&amp; var.manage_aws_auth ? 1 : 0

  metadata {
    name      = &quot;aws-auth&quot;
    namespace = &quot;kube-system&quot;
    labels = merge(
      {
        &quot;app.kubernetes.io/managed-by&quot; = &quot;Terraform&quot;
        # / are replaced by . because label validator fails in this lib
        # https://github.com/kubernetes/apimachinery/blob/1bdd76d09076d4dc0362456e59c8f551f5f24a72/pkg/util/validation/validation.go#L166
        &quot;terraform.io/module&quot; = &quot;terraform-aws-modules.eks.aws&quot;
      },
      var.aws_auth_additional_labels
    )
  }

  lifecycle {
    ignore_changes = [
      data,
    ]
  }

  depends_on = [data.http.wait_for_cluster[0]]
}

resource &quot;kubernetes_config_map_v1_data&quot; &quot;aws_auth&quot; {
  count = var.create_eks &amp;&amp; var.manage_aws_auth ? 1 : 0

  metadata {
    name      = &quot;aws-auth&quot;
    namespace = &quot;kube-system&quot;
  }

  data = {
    mapRoles = yamlencode(
      distinct(concat(
        local.configmap_roles,
        var.map_roles,
      ))
    )
    mapAccounts = yamlencode(var.map_accounts)
  }

  field_manager = &quot;aws-eks-module&quot;

  depends_on = [data.http.wait_for_cluster[0], kubernetes_config_map.aws_auth[0]]
}
</code></pre>
<p>From another repo:</p>
<pre><code>resource &quot;kubernetes_config_map_v1_data&quot; &quot;aws_auth_example&quot; {
  metadata {
    name      = &quot;aws-auth&quot;
    namespace = &quot;kube-system&quot;
  }

  data = {
    mapUsers = yamlencode(var.users)
  }

  field_manager = &quot;example&quot;
}
</code></pre>
