<p>I am currently provision my EKS cluster/s using EKSCTL and I want to use Terraform to provision the cluster/s. I am using Terraform EKS module to create cluster. I have use EKSCTL to create identity mapping with following command</p>
<pre><code>eksctl create iamidentitymapping -- region us-east-1 --cluster stage-cluster --arn arn:aws:iam::111222333444:role/developer --username dev-service
</code></pre>
<p>I want to convert this command to Terraform with following, but it is not the best way</p>
<pre><code>  resource &quot;null_resource&quot; &quot;eks-identity-mapping&quot; {
  depends_on = [
    module.eks,
    aws_iam_policy_attachment.eks-policy-attachment
  ]
  provisioner &quot;local-exec&quot; {
    command = &lt;&lt;EOF
      eksctl create iamidentitymapping \
      --cluster ${var.eks_cluster_name} \
      --arn ${data.aws_iam_role.mwaa_role.arn} \
      --username ${var.mwaa_username} \
      --profile ${var.aws_profile} \
      --region ${var.mwaa_aws_region}
    EOF
  }
}
</code></pre>
<p>How can I use Kubernetes provider to achieve this</p>

Ruwan Vimukthi Mettananda
<p>I haven't found a clear matching for this particular command, but you can achieve something similar by setting the <code>aws-auth</code> config map in kubernetes, adding all of the users/roles and their access rights in one go.</p>
<p>For example we use something like the following below to supply the list of admins to our cluster:</p>
<pre class="lang-rb prettyprint-override"><code>resource &quot;kubernetes_config_map&quot; &quot;aws_auth&quot; {
  metadata {
    name      = &quot;aws-auth&quot;
    namespace = &quot;kube-system&quot;
  }

  data = {
    mapRoles = &lt;&lt;CONFIGMAPAWSAUTH
- rolearn: ${var.k8s-node-iam-arn}
  username: system:node:{{EC2PrivateDNSName}}
  groups:
    - system:bootstrappers
    - system:nodes
- rolearn: arn:aws:iam::111222333444:role/developer
  username: dev-service
  groups:
    - system:masters
CONFIGMAPAWSAUTH
  }
}
</code></pre>
<p>Note that this file contains all of the role mappings, so you should make sure <code>var.k8s-node-iam-arn</code> is set to the superuser of the cluster otherwise you can get locked out. Also you have to set what access these roles will get.</p>
<p>You can also add specific IAM users instead of roles as well:</p>
<pre class="lang-yaml prettyprint-override"><code>- userarn: arn:aws:iam::1234:user/user.first
  username: user.first
  groups:
    - system:masters
</code></pre>
