Map IAM group to EKS ConfigMap

aws-auth-cm.sh

#!/usr/bin/env bash

set -o errexit
set -o nounset
set -o pipefail

IAM_GROUP=${1:-admins}
EKS_ROLE_ARN=${2:-arn:aws:iam::111122223333:role/eks-node-role}
RBAC_GROUP=${3:-system:masters}

mapusers(){
    local IAM_GROUP_NAME=$1
    local RBAC_GROUP=$2
    local USER_LIST=""
    
    USER_LIST="$(aws iam get-group --group-name "${IAM_GROUP_NAME}" --query 'Users[*].Arn' --output text)"

    for user in ${USER_LIST}
    do
    echo -n "
    - userarn: ${user}
      username: ${user#*/}
      groups:
        - ${RBAC_GROUP}"
    done
}

cat <<EOF | kubectl apply -f -
apiVersion: v1
kind: ConfigMap
metadata:
  name: aws-auth
  namespace: kube-system
data:
  mapRoles: |
    - rolearn: ${EKS_ROLE_ARN}
      username: system:node:{{EC2PrivateDNSName}}
      groups:
        - system:bootstrappers
        - system:nodes
  mapUsers: |
$(mapusers "${IAM_GROUP}" "${RBAC_GROUP}") 
EOF