### Basic Usage Example

Source: https://github.com/terraform-aws-modules/terraform-aws-eks-pod-identity/blob/master/_autodocs/api-reference.md

Demonstrates a basic configuration for the terraform-aws-eks-pod-identity module, including custom policy statements and a pod identity association. This example shows how to attach a custom policy with S3 list actions and configure an association for a specific Kubernetes service account.

```hcl
module "custom_pod_identity" {
  source = "terraform-aws-modules/eks-pod-identity/aws"

  name = "custom"

  attach_custom_policy = true
  policy_statements = [
    {
      sid       = "S3"
      actions   = ["s3:List*"]
      resources = ["*"]
    }
  ]

  associations = {
    custom-association = {
      cluster_name    = "example-cluster"
      namespace       = "custom-namespace"
      service_account = "custom-service-account"
    }
  }

  tags = {
    Environment = "dev"
  }
}
```

--------------------------------

### Single Service, One Association Example

Source: https://github.com/terraform-aws-modules/terraform-aws-eks-pod-identity/blob/master/_autodocs/variables-guide.md

Demonstrates a basic setup for a single service (ExternalDNS) with one Kubernetes service account association. It includes attaching the relevant policy and specifying the hosted zone ARN for DNS configuration.

```hcl
module "external_dns" {
  source = "terraform-aws-modules/eks-pod-identity/aws"

  name                               = "external-dns"
  attach_external_dns_policy         = true
  external_dns_hosted_zone_arns      = [aws_route53_zone.main.arn]

  associations = {
    this = {
      cluster_name    = aws_eks_cluster.main.name
      namespace       = "kube-system"
      service_account = "external-dns"
    }
  }
}
```

--------------------------------

### Multiple Services with Separate Modules Example

Source: https://github.com/terraform-aws-modules/terraform-aws-eks-pod-identity/blob/master/_autodocs/outputs.md

Illustrates setting up multiple services (external-dns, cert-manager, cluster-autoscaler) using separate module blocks and then aggregating their role and policy ARNs into a single output map.

```HCL
module "external_dns" {
  # ... configuration ...
}

module "cert_manager" {
  # ... configuration ...
}

module "cluster_autoscaler" {
  # ... configuration ...
}

output "pod_identities" {
  value = {
    external_dns = {
      role_arn = module.external_dns.iam_role_arn
      policy_arn = module.external_dns.iam_policy_arn
    }
    cert_manager = {
      role_arn = module.cert_manager.iam_role_arn
      policy_arn = module.cert_manager.iam_policy_arn
    }
    cluster_autoscaler = {
      role_arn = module.cluster_autoscaler.iam_role_arn
      policy_arn = module.cluster_autoscaler.iam_policy_arn
    }
  }
}
```

--------------------------------

### Single Service Association Example

Source: https://github.com/terraform-aws-modules/terraform-aws-eks-pod-identity/blob/master/_autodocs/outputs.md

Demonstrates configuring a single service (external-dns) with its association, and outputs its role ARN, policy ARN, and association ARN.

```HCL
module "external_dns" {
  source = "terraform-aws-modules/eks-pod-identity/aws"
  
  name = "external-dns"
  
  attach_external_dns_policy = true
  external_dns_hosted_zone_arns = [aws_route53_zone.main.arn]
  
  associations = {
    this = {
      cluster_name    = aws_eks_cluster.main.name
      namespace       = "kube-system"
      service_account = "external-dns"
    }
  }
}

output "external_dns_role_arn" {
  value = module.external_dns.iam_role_arn
}

output "external_dns_policy_arn" {
  value = module.external_dns.iam_policy_arn
}

output "external_dns_association_arn" {
  value = module.external_dns.associations["this"].pod_identity_association_arn
}
```

--------------------------------

### Pod Identity Association Example

Source: https://github.com/terraform-aws-modules/terraform-aws-eks-pod-identity/blob/master/_autodocs/api-reference.md

Illustrates the structure for defining a Pod Identity association within the module's configuration. This example specifies the Kubernetes cluster name, namespace, and service account for the association.

```hcl
associations = {
  "my-association" = {
    cluster_name    = "my-cluster"
    namespace       = "my-namespace"
    service_account = "my-service-account"
  }
}
```

--------------------------------

### Multi-Service, Single Module Example

Source: https://github.com/terraform-aws-modules/terraform-aws-eks-pod-identity/blob/master/_autodocs/variables-guide.md

Illustrates deploying multiple services (ExternalDNS, Cluster Autoscaler) using a single module. This pattern shares IAM roles, which is generally not recommended for security best practices. It configures policies and associations for both services.

```hcl
module "cluster_services" {
  source = "terraform-aws-modules/eks-pod-identity/aws"

  name = "cluster-services"

  attach_external_dns_policy       = true
  attach_cluster_autoscaler_policy = true

  external_dns_hosted_zone_arns      = [aws_route53_zone.main.arn]
  cluster_autoscaler_cluster_names   = [aws_eks_cluster.main.name]

  associations = {
    external-dns = {
      cluster_name    = aws_eks_cluster.main.name
      namespace       = "kube-system"
      service_account = "external-dns"
    }
    cluster-autoscaler = {
      cluster_name    = aws_eks_cluster.main.name
      namespace       = "kube-system"
      service_account = "cluster-autoscaler"
    }
  }
}
```

--------------------------------

### Terragrunt Example: Managing Multiple S3 Buckets

Source: https://github.com/terraform-aws-modules/terraform-aws-eks-pod-identity/blob/master/wrappers/README.md

This Terragrunt configuration shows how to manage multiple S3 buckets using the wrapper module. It defines default settings and specific configurations for each bucket.

```hcl
terraform {
  source = "tfr:///terraform-aws-modules/eks-pod-identity/aws//wrappers"
  # Alternative source:
  # source = "git::git@github.com:terraform-aws-modules/terraform-aws-eks-pod-identity.git//wrappers?ref=master"
}

inputs = {
  defaults = {
    force_destroy = true

    attach_elb_log_delivery_policy        = true
    attach_lb_log_delivery_policy         = true
    attach_deny_insecure_transport_policy = true
    attach_require_latest_tls_policy      = true
  }

  items = {
    bucket1 = {
      bucket = "my-random-bucket-1"
    }
    bucket2 = {
      bucket = "my-random-bucket-2"
      tags = {
        Secure = "probably"
      }
    }
  }
}
```

--------------------------------

### Basic Cert Manager Configuration

Source: https://github.com/terraform-aws-modules/terraform-aws-eks-pod-identity/blob/master/_autodocs/variables-guide.md

Example of configuring the Cert Manager integration. This includes attaching the necessary policy and specifying Route 53 hosted zone ARNs for DNS validation. An association maps the Kubernetes service account to the EKS cluster.

```hcl
module "cert_manager" {
  source = "terraform-aws-modules/eks-pod-identity/aws"

  name = "cert-manager"

  attach_cert_manager_policy = true
  cert_manager_hosted_zone_arns = [
    aws_route53_zone.main.arn,
    aws_route53_zone.secondary.arn
  ]

  associations = {
    main = {
      cluster_name    = aws_eks_cluster.main.name
      namespace       = "cert-manager"
      service_account = "cert-manager"
    }
  }

  tags = {
    Component = "CertManager"
  }
}
```

--------------------------------

### Basic EKS Pod Identity Module Usage

Source: https://github.com/terraform-aws-modules/terraform-aws-eks-pod-identity/blob/master/_autodocs/README.md

This example demonstrates the basic usage of the EKS Pod Identity module to create a role for Cert Manager. It attaches the Cert Manager policy and configures an association for a specific Kubernetes service account.

```hcl
module "cert_manager_pod_identity" {
  source = "terraform-aws-modules/eks-pod-identity/aws"

  name = "cert-manager"

  attach_cert_manager_policy = true
  cert_manager_hosted_zone_arns = ["arn:aws:route53:::hostedzone/Z123456"]

  associations = {
    main = {
      cluster_name    = "my-cluster"
      namespace       = "cert-manager"
      service_account = "cert-manager"
    }
  }

  tags = {
    Environment = "production"
  }
}

output "role_arn" {
  value = module.cert_manager_pod_identity.iam_role_arn
}
```

--------------------------------

### Multiple Services Configuration

Source: https://github.com/terraform-aws-modules/terraform-aws-eks-pod-identity/blob/master/_autodocs/variables-guide.md

Example of attaching policies for multiple services (ExternalDNS, Cluster Autoscaler, AWS Load Balancer Controller) within a single module. It configures associations for each service's Kubernetes service account and uses default association settings.

```hcl
module "eks_addons" {
  source = "terraform-aws-modules/eks-pod-identity/aws"

  name = "eks-addons"

  attach_external_dns_policy         = true
  attach_cluster_autoscaler_policy   = true
  attach_aws_lb_controller_policy    = true

  external_dns_hosted_zone_arns = [
    "arn:aws:route53:::hostedzone/Z123456"
  ]

  cluster_autoscaler_cluster_names = ["my-cluster"]

  association_defaults = {
    cluster_name = "my-cluster"
  }

  associations = {
    external-dns = {
      namespace       = "kube-system"
      service_account = "external-dns"
    }
    cluster-autoscaler = {
      namespace       = "kube-system"
      service_account = "cluster-autoscaler"
    }
    aws-load-balancer-controller = {
      namespace       = "kube-system"
      service_account = "aws-load-balancer-controller"
    }
  }
}
```

--------------------------------

### Configure Cross-Cluster Service Access

Source: https://github.com/terraform-aws-modules/terraform-aws-eks-pod-identity/blob/master/_autodocs/variables-guide.md

This snippet demonstrates how to limit a service, like external-dns, to specific clusters in a multi-cluster setup. It uses `for_each` to iterate over a set of cluster keys, attaching an external-dns policy and associating the service account with specific cluster details.

```hcl
module "external_dns" {
  for_each = toset(["prod", "staging"])

  source = "terraform-aws-modules/eks-pod-identity/aws"

  name = "external-dns-${each.key}"

  attach_external_dns_policy = true
  external_dns_hosted_zone_arns = [
    aws_route53_zone.shared.arn
  ]

  associations = {
    main = {
      cluster_name    = aws_eks_cluster.main[each.key].name
      namespace       = "kube-system"
      service_account = "external-dns"
    }
  }
}
```

--------------------------------

### IAM Role Policy Attachment Example

Source: https://github.com/terraform-aws-modules/terraform-aws-eks-pod-identity/blob/master/_autodocs/resources.md

Attaches additional IAM policies to the main role. Use when `var.additional_policy_arns` is provided.

```hcl
resource "aws_iam_role_policy_attachment" "this" {
  for_each = { for k, v in var.additional_policy_arns : k => v if var.create }

  role       = aws_iam_role.this[0].name
  policy_arn = each.value
}
```

--------------------------------

### Custom Policy with Multiple Scopes

Source: https://github.com/terraform-aws-modules/terraform-aws-eks-pod-identity/blob/master/_autodocs/variables-guide.md

Example of attaching a custom IAM policy with specific S3 and DynamoDB permissions. It also demonstrates adding an additional managed policy ARN for CloudWatch Agent. Multiple associations for different environments (prod, staging) are shown.

```hcl
module "app_identity" {
  source = "terraform-aws-modules/eks-pod-identity/aws"

  name = "my-app"

  attach_custom_policy = true
  policy_statements = [
    {
      sid       = "S3Access"
      actions   = ["s3:GetObject", "s3:PutObject"]
      resources = ["arn:aws:s3:::app-bucket/*"]
    },
    {
      sid       = "DynamoDBAccess"
      actions   = ["dynamodb:GetItem", "dynamodb:Query"]
      resources = ["arn:aws:dynamodb:*:*:table/app-*"]
    }
  ]

  additional_policy_arns = {
    cloudwatch = "arn:aws:iam::aws:policy/CloudWatchAgentServerPolicy"
  }

  associations = {
    prod = {
      cluster_name    = "prod-cluster"
      namespace       = "production"
      service_account = "my-app"
    }
    staging = {
      cluster_name    = "staging-cluster"
      namespace       = "staging"
      service_account = "my-app"
    }
  }
}
```

--------------------------------

### Terraform Initialization, Plan, and Apply

Source: https://github.com/terraform-aws-modules/terraform-aws-eks-pod-identity/blob/master/examples/complete/README.md

Standard Terraform commands to initialize the project, review changes, and apply the configuration. Ensure you have AWS credentials configured.

```bash
terraform init
terraform plan
terraform apply
```

--------------------------------

### Module Documentation File Structure

Source: https://github.com/terraform-aws-modules/terraform-aws-eks-pod-identity/blob/master/_autodocs/SUMMARY.md

This is a quick reference for the generated documentation files and their primary purposes. It helps users navigate to the most relevant document for their needs.

```plaintext
/workspace/home/output/
├── README.md           ← Start here
├── configuration.md    ← All variables
├── modules.md          ← Service details
├── outputs.md          ← Module outputs
├── api-reference.md    ← Module interface
├── resources.md        ← AWS resources
├── types.md            ← Type definitions
├── variables-guide.md  ← Patterns & examples
├── INDEX.md            ← Navigation guide
└── MANIFEST.txt        ← This summary
```

--------------------------------

### Conditionally Create Resources

Source: https://github.com/terraform-aws-modules/terraform-aws-eks-pod-identity/blob/master/_autodocs/variables-guide.md

Use the 'create' variable to conditionally deploy resources. Set to 'false' to prevent resource creation, useful for testing or environment-specific deployments.

```hcl
module "pod_identity" {
  create = var.environment == "prod" ? true : false
}
```

--------------------------------

### Configure AWS VPC CNI Options

Source: https://github.com/terraform-aws-modules/terraform-aws-eks-pod-identity/blob/master/_autodocs/variables-guide.md

Set IPv4 and IPv6 support, and enable CloudWatch logs for the AWS VPC CNI. Ensure `attach_aws_vpc_cni_policy` is set to true to apply these configurations.

```hcl
attach_aws_vpc_cni_policy = true
aws_vpc_cni_enable_ipv4   = true
aws_vpc_cni_enable_ipv6   = false  # Don't enable IPv6 yet
aws_vpc_cni_enable_cloudwatch_logs = true
```

--------------------------------

### Configure Velero Policy

Source: https://github.com/terraform-aws-modules/terraform-aws-eks-pod-identity/blob/master/_autodocs/modules.md

Enable the Velero policy and specify S3 bucket ARNs for backup operations, and optionally KMS key ARNs for encrypted bucket operations.

```hcl
attach_velero_policy = true
velero_s3_bucket_arns = ["arn:aws:s3:::velero-backups"]
velero_s3_bucket_path_arns = ["arn:aws:s3:::velero-backups/example/*"]
velero_kms_arns = ["arn:aws:kms:*:*:key/1234abcd-12ab-34cd-56ef-1234567890ab"]
```

--------------------------------

### Configure External DNS Policy

Source: https://github.com/terraform-aws-modules/terraform-aws-eks-pod-identity/blob/master/_autodocs/modules.md

Enable the External DNS policy by setting the attach_external_dns_policy variable to true and providing the necessary Route53 hosted zone ARNs.

```hcl
attach_external_dns_policy = true
external_dns_hosted_zone_arns = ["arn:aws:route53:::hostedzone/IClearlyMadeThisUp"]
```

--------------------------------

### Configure External Secrets Options

Source: https://github.com/terraform-aws-modules/terraform-aws-eks-pod-identity/blob/master/_autodocs/variables-guide.md

Enable secret creation/deletion permissions for external secrets. Be cautious when setting `external_secrets_create_permission` to true due to security implications. Specify SSM Parameter Store and Secrets Manager ARNs for secret retrieval.

```hcl
attach_external_secrets_policy = true
external_secrets_create_permission = true  # Risky!
external_secrets_ssm_parameter_arns = ["arn:aws:ssm:*:*:parameter/app/*"]
external_secrets_secrets_manager_arns = ["arn:aws:secretsmanager:*:*:secret:app/*"]
```

--------------------------------

### Manage IAM Role Naming with Prefix

Source: https://github.com/terraform-aws-modules/terraform-aws-eks-pod-identity/blob/master/_autodocs/variables-guide.md

The 'use_name_prefix' variable controls whether the 'name' variable is used as an exact name or a prefix with a random suffix. Using a prefix (default) allows for in-place role replacement and zero-downtime deployments.

```hcl
# With prefix (default)
use_name_prefix = true
name = "external-dns"
# Result: external-dns-abc123xyz

# Without prefix
use_name_prefix = false
name = "external-dns"
# Result: external-dns
```

--------------------------------

### Enable Cert Manager Policy

Source: https://github.com/terraform-aws-modules/terraform-aws-eks-pod-identity/blob/master/_autodocs/modules.md

Attach the Cert Manager policy by setting this variable to true. Requires Route53 hosted zone ARNs.

```hcl
attach_cert_manager_policy = true
cert_manager_hosted_zone_arns = ["arn:aws:route53:::hostedzone/IClearlyMadeThisUp"]
```

--------------------------------

### Configure Load Balancer Controller TargetGroup Binding

Source: https://github.com/terraform-aws-modules/terraform-aws-eks-pod-identity/blob/master/_autodocs/variables-guide.md

Choose between attaching the full Load Balancer Controller policy or a limited policy for TargetGroup binding only. Specify the ARNs for the target groups if using the limited policy.

```hcl
# Option 1: Full LB Controller permissions
attach_aws_lb_controller_policy = true

# Option 2: TargetGroup Binding only
attach_aws_lb_controller_targetgroup_binding_only_policy = true
aws_lb_controller_targetgroup_arns = [
  "arn:aws:elasticloadbalancing:*:*:targetgroup/my-tg/*"
]
```

--------------------------------

### Configure Custom IAM Policy

Source: https://github.com/terraform-aws-modules/terraform-aws-eks-pod-identity/blob/master/_autodocs/modules.md

Enable custom IAM policies by setting attach_custom_policy to true and defining policy statements with actions and resources. External policy documents can also be merged or overridden.

```hcl
attach_custom_policy = true
policy_statements = [
  {
    sid       = "S3"
    actions   = ["s3:GetObject"]
    resources = ["arn:aws:s3:::my-bucket/*"]
  }
]
```

--------------------------------

### Enable AppMesh Controller Policy

Source: https://github.com/terraform-aws-modules/terraform-aws-eks-pod-identity/blob/master/_autodocs/modules.md

Attach the IAM policy for the AppMesh Controller by setting this variable to true. This grants broad permissions for App Mesh and service discovery.

```hcl
attach_aws_appmesh_controller_policy = true
```

--------------------------------

### Enable AppMesh Envoy Proxy Policy

Source: https://github.com/terraform-aws-modules/terraform-aws-eks-pod-identity/blob/master/_autodocs/modules.md

Enable the IAM policy required for the AppMesh Envoy proxy. This allows the proxy to stream aggregated resources.

```hcl
attach_aws_appmesh_envoy_proxy_policy = true
```

--------------------------------

### Configure Mountpoint S3 CSI Driver Policy

Source: https://github.com/terraform-aws-modules/terraform-aws-eks-pod-identity/blob/master/_autodocs/modules.md

Enable the Mountpoint S3 CSI policy and specify S3 bucket ARNs for ListBucket operations and S3 path ARNs for object operations.

```hcl
attach_mountpoint_s3_csi_policy = true
mountpoint_s3_csi_bucket_arns = ["arn:aws:s3:::mountpoint-s3"]
mountpoint_s3_csi_bucket_path_arns = ["arn:aws:s3:::mountpoint-s3/example/*"]
```

--------------------------------

### Enable Cluster Autoscaler Policy

Source: https://github.com/terraform-aws-modules/terraform-aws-eks-pod-identity/blob/master/_autodocs/modules.md

Enable the Cluster Autoscaler policy by setting this to true. Requires cluster names for scoping.

```hcl
attach_cluster_autoscaler_policy = true
cluster_autoscaler_cluster_names = ["foo"]
```

--------------------------------

### Enable AWS Node Termination Handler Policy

Source: https://github.com/terraform-aws-modules/terraform-aws-eks-pod-identity/blob/master/_autodocs/modules.md

Attach the AWS Node Termination Handler policy by setting this to true. Requires SQS queue ARNs for termination events.

```hcl
attach_aws_node_termination_handler_policy = true
aws_node_termination_handler_sqs_queue_arns = ["arn:aws:sqs:*:*:eks-node-termination-handler"]
```

--------------------------------

### Configure Custom IAM Policy Statements

Source: https://github.com/terraform-aws-modules/terraform-aws-eks-pod-identity/blob/master/_autodocs/variables-guide.md

List of IAM policy statements for custom permissions. Each statement defines actions, resources, and effect (Allow/Deny).

```hcl
attach_custom_policy = true
policy_statements = [
  {
    sid    = "S3ReadOnly"
    effect = "Allow"
    actions = [
      "s3:GetObject",
      "s3:ListBucket"
    ]
    resources = [
      "arn:aws:s3:::my-bucket/*",
      "arn:aws:s3:::my-bucket"
    ]
  },
  {
    sid    = "DenyDelete"
    effect = "Deny"
    actions = ["s3:DeleteObject"]
    resources = ["arn:aws:s3:::my-bucket/*"]
  }
]
```

--------------------------------

### Apply Tags to Resources

Source: https://github.com/terraform-aws-modules/terraform-aws-eks-pod-identity/blob/master/_autodocs/variables-guide.md

Use the 'tags' variable to apply custom tags to all created resources, facilitating organization and cost allocation.

```hcl
tags = {
  Environment = "production"
  Team        = "platform"
  ManagedBy   = "terraform"
}
```

--------------------------------

### Enable AWS Load Balancer Controller Policy

Source: https://github.com/terraform-aws-modules/terraform-aws-eks-pod-identity/blob/master/_autodocs/modules.md

Set this variable to true to attach the AWS Load Balancer Controller policy. The policy name is customizable.

```hcl
attach_aws_lb_controller_policy = true
```

--------------------------------

### Create Multiple Associations with Defaults

Source: https://github.com/terraform-aws-modules/terraform-aws-eks-pod-identity/blob/master/_autodocs/README.md

Efficiently manage multiple service account associations within a single EKS Pod Identity module by leveraging association defaults. This approach reduces repetition for common configurations like cluster name and namespace.

```hcl
module "eks_services" {
  source = "terraform-aws-modules/eks-pod-identity/aws"

  name = "eks-core-services"

  # Use defaults to reduce repetition
  association_defaults = {
    cluster_name = aws_eks_cluster.main.name
    namespace    = "kube-system"
  }

  associations = {
    external-dns = {
      service_account = "external-dns"
    }
    cert-manager = {
      service_account = "cert-manager"
      namespace       = "cert-manager"  # Override namespace
    }
    cluster-autoscaler = {
      service_account = "cluster-autoscaler"
    }
  }

  # Configure the services
  attach_external_dns_policy       = true
  attach_cert_manager_policy       = true
  attach_cluster_autoscaler_policy = true

  external_dns_hosted_zone_arns    = [aws_route53_zone.main.arn]
  cert_manager_hosted_zone_arns    = [aws_route53_zone.main.arn]
  cluster_autoscaler_cluster_names = [aws_eks_cluster.main.name]
}

```

--------------------------------

### Limit Permissions to Specific Resources

Source: https://github.com/terraform-aws-modules/terraform-aws-eks-pod-identity/blob/master/_autodocs/README.md

Configure the module to attach specific IAM policies for services like Velero, scoping permissions to particular S3 buckets, paths, and KMS keys. This ensures the principle of least privilege is applied by restricting access to only necessary resources.

```hcl
module "velero_backup" {
  source = "terraform-aws-modules/eks-pod-identity/aws"

  name = "velero"

  attach_velero_policy = true

  # Scope to specific S3 buckets and KMS keys
  velero_s3_bucket_arns = [
    aws_s3_bucket.velero.arn
  ]
  velero_s3_bucket_path_arns = [
    "${aws_s3_bucket.velero.arn}/*"
  ]
  velero_kms_arns = [
    aws_kms_key.velero.arn
  ]

  associations = {
    this = {
      cluster_name    = aws_eks_cluster.main.name
      namespace       = "velero"
      service_account = "velero"
    }
  }
}
```

--------------------------------

### Enable AWS EBS CSI Driver Policy

Source: https://github.com/terraform-aws-modules/terraform-aws-eks-pod-identity/blob/master/_autodocs/modules.md

Configure this to attach the IAM policy for the AWS EBS CSI Driver. It requires KMS key ARNs if you intend to manage encrypted volumes.

```hcl
attach_aws_ebs_csi_policy = true
aws_ebs_csi_kms_arns = ["arn:aws:kms:*:*:key/1234abcd-12ab-34cd-56ef-1234567890ab"]
```

--------------------------------

### Terraform Configuration for EKS Pod Identity Wrapper

Source: https://github.com/terraform-aws-modules/terraform-aws-eks-pod-identity/blob/master/wrappers/README.md

This Terraform configuration demonstrates how to use the EKS Pod Identity module wrapper. It allows for managing multiple module configurations within a single Terraform block.

```hcl
module "wrapper" {
  source = "terraform-aws-modules/eks-pod-identity/aws//wrappers"

  defaults = { # Default values
    create = true
    tags = {
      Terraform   = "true"
      Environment = "dev"
    }
  }

  items = {
    my-item = {
      # omitted... can be any argument supported by the module
    }
    my-second-item = {
      # omitted... can be any argument supported by the module
    }
    # omitted...
  }
}
```

--------------------------------

### Enable Amazon Managed Service for Prometheus Policy

Source: https://github.com/terraform-aws-modules/terraform-aws-eks-pod-identity/blob/master/_autodocs/modules.md

Use this configuration to attach the pre-defined IAM policy for Amazon Managed Service for Prometheus. Requires specifying the ARNs of the AMP Workspaces.

```hcl
attach_amazon_managed_service_prometheus_policy = true
amazon_managed_service_prometheus_workspace_arns = ["arn:aws:prometheus:*:*:workspace/foo"]
```

--------------------------------

### Configure External Secrets Policy

Source: https://github.com/terraform-aws-modules/terraform-aws-eks-pod-identity/blob/master/_autodocs/modules.md

Enable the External Secrets policy and specify ARNs for SSM parameters, Secrets Manager secrets, and KMS keys. Optionally allow the creation and deletion of secrets.

```hcl
attach_external_secrets_policy = true
external_secrets_ssm_parameter_arns = ["arn:aws:ssm:*:*:parameter/foo"]
external_secrets_secrets_manager_arns = ["arn:aws:secretsmanager:*:*:secret:bar"]
external_secrets_kms_key_arns = ["arn:aws:kms:*:*:key/1234abcd-12ab-34cd-56ef-1234567890ab"]
external_secrets_create_permission = true
```

--------------------------------

### Terragrunt Configuration for EKS Pod Identity Wrapper

Source: https://github.com/terraform-aws-modules/terraform-aws-eks-pod-identity/blob/master/wrappers/README.md

Use this Terragrunt configuration to manage multiple instances of the EKS Pod Identity module. It leverages the wrapper pattern for scenarios where `for_each` is not suitable.

```hcl
terraform {
  source = "tfr:///terraform-aws-modules/eks-pod-identity/aws//wrappers"
  # Alternative source:
  # source = "git::git@github.com:terraform-aws-modules/terraform-aws-eks-pod-identity.git//wrappers?ref=master"
}

inputs = {
  defaults = { # Default values
    create = true
    tags = {
      Terraform   = "true"
      Environment = "dev"
    }
  }

  items = {
    my-item = {
      # omitted... can be any argument supported by the module
    }
    my-second-item = {
      # omitted... can be any argument supported by the module
    }
    # omitted...
  }
}
```

--------------------------------

### Enable PGAnalyze Policy

Source: https://github.com/terraform-aws-modules/terraform-aws-eks-pod-identity/blob/master/_autodocs/modules.md

Enable the PGAnalyze policy by setting the attach_pganalyze_policy variable to true. This grants CloudWatch-related permissions for PostgreSQL monitoring.

```hcl
attach_pganalyze_policy = true
```

--------------------------------

### Enable AWS VPC CNI Policy

Source: https://github.com/terraform-aws-modules/terraform-aws-eks-pod-identity/blob/master/_autodocs/modules.md

Configure the AWS VPC CNI policy by setting this to true. Optional parameters control IPv4, IPv6, and CloudWatch Logs permissions.

```hcl
attach_aws_vpc_cni_policy = true
aws_vpc_cni_enable_ipv4   = true
aws_vpc_cni_enable_ipv6   = false
aws_vpc_cni_enable_cloudwatch_logs = false
```

--------------------------------

### Configure External DNS with EKS Pod Identity

Source: https://github.com/terraform-aws-modules/terraform-aws-eks-pod-identity/blob/master/README.md

Use this snippet to attach the External DNS policy and specify hosted zone ARNs for EKS Pod Identity.

```hcl
module "external_dns_pod_identity" {
  source = "terraform-aws-modules/eks-pod-identity/aws"

  name = "external-dns"

  attach_external_dns_policy    = true
  external_dns_hosted_zone_arns = ["arn:aws:route53:::hostedzone/IClearlyMadeThisUp"]

  associations = {
    this = {
      cluster_name    = "example"
      namespace       = "external-dns"
      service_account = "external-dns-sa"
    }
  }

  tags = {
    Environment = "dev"
  }
}
```

--------------------------------

### Pod Identity Association Defaults and Associations Object Structure

Source: https://github.com/terraform-aws-modules/terraform-aws-eks-pod-identity/blob/master/_autodocs/configuration.md

Defines the structure for default values and specific configurations for Pod Identity associations. This allows setting common parameters or defining individual associations with specific role bindings.

```HCL
{
  cluster_name         = optional(string)
  disable_session_tags = optional(bool)
  namespace            = optional(string)
  service_account      = optional(string)
  role_arn             = optional(string)
  target_role_arn      = optional(string)
  tags                 = optional(map(string), {})
}
```

--------------------------------

### Configure Maximum Session Duration

Source: https://github.com/terraform-aws-modules/terraform-aws-eks-pod-identity/blob/master/_autodocs/variables-guide.md

Set the 'max_session_duration' to control the maximum duration for temporary credentials, constrained between 3600 and 43200 seconds.

```hcl
max_session_duration = 3600  # 1 hour
```

--------------------------------

### Configure Velero with EKS Pod Identity

Source: https://github.com/terraform-aws-modules/terraform-aws-eks-pod-identity/blob/master/README.md

Use this snippet to attach the Velero policy to an EKS service account. Specify S3 bucket ARNs for backup storage.

```hcl
module "velero_pod_identity" {
  source = "terraform-aws-modules/eks-pod-identity/aws"

  name = "velero"

  attach_velero_policy       = true
  velero_s3_bucket_arns      = ["arn:aws:s3:::velero-backups"]
  velero_s3_bucket_path_arns = ["arn:aws:s3:::velero-backups/example/*"]

  associations = {
    this = {
      cluster_name    = "example"
      namespace       = "velero"
      service_account = "velero-server"
    }
  }

  tags = {
    Environment = "dev"
  }
}
```

--------------------------------

### Configure AWS FSx for Lustre CSI Driver with EKS Pod Identity

Source: https://github.com/terraform-aws-modules/terraform-aws-eks-pod-identity/blob/master/README.md

Use this snippet to attach the AWS FSx for Lustre CSI policy and specify the service role ARNs for EKS Pod Identity.

```hcl
module "aws_fsx_lustre_csi_pod_identity" {
  source = "terraform-aws-modules/eks-pod-identity/aws"

  name = "aws-fsx-lustre-csi"

  attach_aws_fsx_lustre_csi_policy     = true
  aws_fsx_lustre_csi_service_role_arns = ["arn:aws:iam::*:role/aws-service-role/s3.data-source.lustre.fsx.amazonaws.com/*"]

  associations = {
    this = {
      cluster_name    = "example"
      namespace       = "kube-system"
      service_account = "fsx-csi-controller-sa"
    }
  }

  tags = {
    Environment = "dev"
  }
}
```

--------------------------------

### Enable AWS FSx for Lustre CSI Driver Policy

Source: https://github.com/terraform-aws-modules/terraform-aws-eks-pod-identity/blob/master/_autodocs/modules.md

Use this configuration to attach the IAM policy for the AWS FSx for Lustre CSI Driver. It requires the ARNs of the FSx service-linked roles.

```hcl
attach_aws_fsx_lustre_csi_policy = true
aws_fsx_lustre_csi_service_role_arns = ["arn:aws:iam::*:role/aws-service-role/s3.data-source.lustre.fsx.amazonaws.com/*"]
```

--------------------------------

### Reference External Policy Documents

Source: https://github.com/terraform-aws-modules/terraform-aws-eks-pod-identity/blob/master/_autodocs/variables-guide.md

List of external IAM policy documents to merge as a base for custom policies. Use this to reference pre-existing policy documents.

```hcl
source_policy_documents = [
  data.aws_iam_policy_document.base.json,
  aws_iam_policy.additional.json
]
```

--------------------------------

### Enable AWS Gateway Controller Policy

Source: https://github.com/terraform-aws-modules/terraform-aws-eks-pod-identity/blob/master/_autodocs/modules.md

Attach the IAM policy for the AWS Gateway Controller by setting this variable to true. This grants permissions for network interface management and Load Balancing.

```hcl
attach_aws_gateway_controller_policy = true
```

--------------------------------

### Add IAM Role Description

Source: https://github.com/terraform-aws-modules/terraform-aws-eks-pod-identity/blob/master/_autodocs/variables-guide.md

The 'description' variable provides an optional description for the IAM role, aiding in identification and management.

```hcl
description = "Pod Identity role for External DNS in EKS cluster"
```

--------------------------------

### Enable IPv6 for VPC CNI

Source: https://github.com/terraform-aws-modules/terraform-aws-eks-pod-identity/blob/master/_autodocs/variables-guide.md

Set to true to enable IPv6 support for the VPC CNI plugin. Can be enabled alongside IPv4.

```hcl
aws_vpc_cni_enable_ipv6 = true
```

--------------------------------

### Enable IPv4 for VPC CNI

Source: https://github.com/terraform-aws-modules/terraform-aws-eks-pod-identity/blob/master/_autodocs/variables-guide.md

Set to true to enable IPv4 support for the VPC CNI plugin. Can be enabled alongside IPv6.

```hcl
aws_vpc_cni_enable_ipv4 = true
```

--------------------------------

### Conditional IAM Policy Creation

Source: https://github.com/terraform-aws-modules/terraform-aws-eks-pod-identity/blob/master/_autodocs/resources.md

Conditionally creates an IAM policy based on `var.create` and a service-specific attach variable.

```hcl
resource "aws_iam_policy" "cert_manager" {
  count = var.create && var.attach_cert_manager_policy ? 1 : 0
  # ...
}
```

--------------------------------

### Pod Identity Associations Output

Source: https://github.com/terraform-aws-modules/terraform-aws-eks-pod-identity/blob/master/_autodocs/outputs.md

Outputs a map of all Pod Identity associations created by the module. The keys correspond to the input variable 'associations', and values are the full resource objects. All attributes of the AWS EKS Pod Identity Association resource are available.

```HCL
output "associations" {
  description = "Map of Pod Identity associations created"
  value       = aws_eks_pod_identity_association.this
}
```

```HCL
module "eks_pod_identity" {
  associations = {
    external-dns = {
      cluster_name    = "my-cluster"
      namespace       = "kube-system"
      service_account = "external-dns"
    }
    cert-manager = {
      cluster_name    = "my-cluster"
      namespace       = "cert-manager"
      service_account = "cert-manager"
    }
  }
}
```

```HCL
output "external_dns_arn" {
  value = module.eks_pod_identity.associations["external-dns"].pod_identity_association_arn
}
```

```HCL
output "all_associations" {
  value = {
    for k, v in module.eks_pod_identity.associations :
    k => v.pod_identity_association_arn
  }
}
```

--------------------------------

### Enable AWS Load Balancer Controller TargetGroup Binding Only Policy

Source: https://github.com/terraform-aws-modules/terraform-aws-eks-pod-identity/blob/master/_autodocs/modules.md

Use this to attach a limited policy for AWS Load Balancer Controller, scoped only to target group binding. Requires target group ARNs.

```hcl
attach_aws_lb_controller_targetgroup_binding_only_policy = true
aws_lb_controller_targetgroup_arns = ["arn:aws:elasticloadbalancing:*:*:targetgroup/foo/bar"]
```

--------------------------------

### Enable AWS CloudWatch Observability Policy

Source: https://github.com/terraform-aws-modules/terraform-aws-eks-pod-identity/blob/master/_autodocs/modules.md

Set this variable to true to attach the IAM policy for AWS CloudWatch Observability. This policy grants permissions for metric alarms and EC2 resource descriptions.

```hcl
attach_aws_cloudwatch_observability_policy = true
```

--------------------------------

### Cert Manager Pod Identity Configuration

Source: https://github.com/terraform-aws-modules/terraform-aws-eks-pod-identity/blob/master/README.md

Set up an IAM role for Cert Manager. This includes attaching the Cert Manager policy and optionally specifying Route 53 hosted zone ARNs for DNS validation. It then associates the role with the Cert Manager service account.

```hcl
module "cert_manager_pod_identity" {
  source = "terraform-aws-modules/eks-pod-identity/aws"

  name = "cert-manager"

  attach_cert_manager_policy    = true
  cert_manager_hosted_zone_arns = ["arn:aws:route53:::hostedzone/IClearlyMadeThisUp"]

  associations = {
    this = {
      cluster_name    = "example"
      namespace       = "cert-manager"
      service_account = "cert-manager"
    }
  }

  tags = {
    Environment = "dev"
  }
}
```

--------------------------------

### Define Custom IAM Policy for Application Pods

Source: https://github.com/terraform-aws-modules/terraform-aws-eks-pod-identity/blob/master/_autodocs/README.md

Create a custom IAM policy for an application's service account in EKS. This snippet defines specific S3 and DynamoDB access permissions required by the application pod.

```hcl
module "app_pod_identity" {
  source = "terraform-aws-modules/eks-pod-identity/aws"

  name = "my-app"

  attach_custom_policy = true
  policy_statements = [
    {
      sid    = "S3Access"
      effect = "Allow"
      actions = [
        "s3:GetObject",
        "s3:PutObject"
      ]
      resources = ["arn:aws:s3:::app-data/*"]
    },
    {
      sid    = "DynamoDBAccess"
      effect = "Allow"
      actions = ["dynamodb:GetItem", "dynamodb:Query"]
      resources = ["arn:aws:dynamodb:*:*:table/app-*"]
    }
  ]

  associations = {
    main = {
      cluster_name    = "my-cluster"
      namespace       = "production"
      service_account = "my-app"
    }
  }

  tags = {
    Application = "MyApp"
  }
}

```