How to attach CloudWatchLogsFullAccess to the IAM role of EKS EC2 instance

Question

I use the module, terraform-aws-modules/eks/aws provision EKS. By default, the module provisions three policies to the EKS EC2 IAM role, AmazonEKSWorkerNodePolicy, AmazonEC2ContainerRegistryReadOnly and AmazonEKS_CNI_Policy. I would like to attach an additional policy, CloudWatchLogsFullAccess to the IAM role. I read the doc. I did not find a way to attach it. I had to logon to the AWS console, manually attach CloudWatchLogsFullAccess to the IAM role. Is there a way to use terraform code to attach it when I use this EKS module provisioning EKS?

I added the code below.

resource "aws_iam_role_policy_attachment" "cloudWatch" {
  role       = module.eks.cluster_iam_role_arn
  policy_arn = "arn:aws:iam::aws:policy/CloudWatchLogsFullAccess"
}

But, it complains "The specified value for roleName is invalid". Error: Error attaching policy arn:aws:iam::aws:policy/CloudWatchLogsFullAccess to IAM Role arn:aws:iam::678515134618:role/my-eks20210303061731134400000005: ValidationError: The specified value for roleName is invalid. It must contain only alphanumeric characters and/or the following: +=,.@_- status code: 400, request id: aee57a35-ae72-499e-8653-e61e795818e4

Answer 1

Once you create your eks cluster, you can get cluster_iam_role_arn _from its outputs. Having the ARN you can attach extra policies to it using aws_iam_role_policy_attachment :

resource "aws_iam_role_policy_attachment" "test-attach" {
  role       = module.myeks.cluster_iam_role_arn
  policy_arn = "arn:aws:iam::aws:policy/CloudWatchLogsFullAccess"
}