使用aws-eks-terraform模块配置aws-ebs-csi-driver插件报错求助

这个错误的核心原因是aws-ebs-csi-driver作为EKS官方插件，必须关联一个具备EBS资源操作权限的IAM角色，你的配置里缺少了这个角色的ARN参数，导致AWS API校验失败。

解决步骤 #

1. 创建EBS CSI Driver所需的IAM角色 #

使用Terraform定义一个IAM角色，并关联AWS托管的AmazonEBSCSIDriverPolicy权限策略：

resource "aws_iam_role" "ebs_csi_driver" {
  name = "eks-ebs-csi-driver-role"

  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Effect = "Allow"
        Principal = {
          Service = "ebs.csi.aws.com"
        }
        Action = "sts:AssumeRole"
      }
    ]
  })
}

resource "aws_iam_role_policy_attachment" "ebs_csi_driver_policy" {
  role       = aws_iam_role.ebs_csi_driver.name
  policy_arn = "arn:aws:iam::aws:policy/service-role/AmazonEBSCSIDriverPolicy"
}

2. 更新cluster_addons配置 #

在aws-ebs-csi-driver的配置块中添加service_account_role_arn参数，指向刚创建的角色ARN：

cluster_addons = {
    coredns = {
      addon_version = "v1.8.7-eksbuild.3"
      resolve_conflicts = "OVERWRITE"
    }
    kube-proxy = {
      addon_version = "v1.24.7-eksbuild.2"
      resolve_conflicts = "OVERWRITE"
    }
    vpc-cni = {
      addon_version = "v1.12.0-eksbuild.1"
      resolve_conflicts = "OVERWRITE"
    }
    aws-ebs-csi-driver = {
      addon_version = "v1.13.0-eksbuild.2"
      resolve_conflicts = "PRESERVE"
      service_account_role_arn = aws_iam_role.ebs_csi_driver.arn
    }
  }

3. 重新执行Terraform操作 #

运行terraform init（新增资源时需初始化），然后terraform plan确认变更，最后terraform apply完成配置更新。

补充说明 #

• 这个IAM角色的信任策略必须允许ebs.csi.aws.com服务主体扮演该角色，否则插件无法获取权限。
• 若已手动创建符合要求的IAM角色，直接将该角色的ARN填入service_account_role_arn即可，无需重复创建角色。

内容的提问来源于stack exchange，提问作者Friedrich Brunzema