feat(env_aws): support eks access entries

docs/data-sources/env_aws.md

@@ -61,6 +61,11 @@ Bring Your Own Cloud (BYOC) AWS environment data source.
 		- `CNAME *.example.com. _.$env_name.altinity.cloud.`
 		- `CNAME *.foo.bar.com. _.$env_name.altinity.cloud.`
 - `datadog` (Attributes) Datadog agent configuration. (see [below for nested schema](#nestedatt--datadog))
+- `eks_access_entries` (Attributes Set) IAM principals granted access to the environment's EKS API (Kubernetes API server). Up to 8 entries.
+
+		The list is authoritative: updating it replaces the entries currently configured, and removing the attribute revokes every entry the provider manages.
+
+		AWS rejects service-linked roles (`arn:aws:iam::123456789012:role/aws-service-role/...`) as EKS access entry principals. (see [below for nested schema](#nestedatt--eks_access_entries))
 - `eks_logging` (Boolean) Enable/Disable EKS control plane logging to CloudWatch (default `false`).
 - `endpoints` (Attributes List) AWS environment VPC endpoint configuration (see [below for nested schema](#nestedatt--endpoints))
 - `external_buckets` (Attributes Set) List of external S3 buckets to allow access to.
@@ -131,6 +136,15 @@ Optional:
 - `metrics_enabled` (Boolean) Set to `true` to enable ClickHouse metrics collection, `false` otherwise (default `false`).
 
 
+<a id="nestedatt--eks_access_entries"></a>
+### Nested Schema for `eks_access_entries`
+
+Required:
+
+- `access_level` (String) Access granted to the principal: `ADMIN` (full cluster administration), `READ_WRITE` (read and write access to namespaced resources) or `READ_ONLY`.
+- `principal_arn` (String) ARN of the IAM role or user to grant access to.
+
+
 <a id="nestedatt--endpoints"></a>
 ### Nested Schema for `endpoints`
 

docs/resources/env_aws.md

@@ -754,6 +754,85 @@ data "altinitycloud_env_aws_status" "this" {
 }
 ```
 
+### AWS environment with EKS access entries:
+```terraform
+resource "altinitycloud_env_certificate" "this" {
+  env_name = "acme-staging"
+}
+
+locals {
+  zones = ["us-east-1a", "us-east-1b"]
+}
+
+provider "aws" {
+  region = "us-east-1"
+}
+
+module "altinitycloud_connect_aws" {
+  source = "altinity/connect-aws/altinitycloud"
+  pem    = altinitycloud_env_certificate.this.pem
+}
+
+resource "altinitycloud_env_aws" "this" {
+  name           = altinitycloud_env_certificate.this.env_name
+  aws_account_id = "123456789012"
+  region         = "us-east-1"
+  zones          = local.zones
+  cidr           = "10.67.0.0/21"
+  load_balancers = {
+    public = {
+      enabled          = true
+      source_ip_ranges = ["0.0.0.0/0"]
+    }
+  }
+  node_groups = [
+    {
+      node_type         = "t4g.large"
+      capacity_per_zone = 10
+      zones             = local.zones
+      reservations      = ["SYSTEM", "ZOOKEEPER"]
+    },
+    {
+      node_type         = "m6i.large"
+      capacity_per_zone = 10
+      zones             = local.zones
+      reservations      = ["CLICKHOUSE"]
+    }
+  ]
+
+  // IAM principals from your own account that can reach the EKS Kubernetes API.
+  // The list is authoritative: entries removed here are revoked on the next apply.
+  eks_access_entries = [
+    {
+      principal_arn = "arn:aws:iam::123456789012:role/platform-admin"
+      access_level  = "ADMIN"
+    },
+    {
+      principal_arn = "arn:aws:iam::123456789012:role/platform-oncall"
+      access_level  = "READ_WRITE"
+    },
+    {
+      principal_arn = "arn:aws:iam::123456789012:user/auditor"
+      access_level  = "READ_ONLY"
+    }
+  ]
+
+  cloud_connect = true
+  depends_on = [
+    // "depends_on" is here to enforce "this resource, then altinitycloud_connect_aws" order on destroy.
+    module.altinitycloud_connect_aws
+  ]
+}
+
+// ⚠️ Environment provisioning is asynchronous.
+// Without this data source, Terraform cannot detect provisioning failures.
+// This data source waits until the environment is fully reconciled and reports errors.
+data "altinitycloud_env_aws_status" "this" {
+  name                           = altinitycloud_env_aws.this.name
+  wait_for_applied_spec_revision = altinitycloud_env_aws.this.spec_revision
+}
+```
+
 <!-- schema generated by tfplugindocs -->
 ## Schema
 
@@ -809,6 +888,11 @@ data "altinitycloud_env_aws_status" "this" {
 		- `CNAME *.example.com. _.$env_name.altinity.cloud.`
 		- `CNAME *.foo.bar.com. _.$env_name.altinity.cloud.`
 - `datadog` (Attributes) Datadog agent configuration. (see [below for nested schema](#nestedatt--datadog))
+- `eks_access_entries` (Attributes Set) IAM principals granted access to the environment's EKS API (Kubernetes API server). Up to 8 entries.
+
+		The list is authoritative: updating it replaces the entries currently configured, and removing the attribute revokes every entry the provider manages.
+
+		AWS rejects service-linked roles (`arn:aws:iam::123456789012:role/aws-service-role/...`) as EKS access entry principals. (see [below for nested schema](#nestedatt--eks_access_entries))
 - `eks_logging` (Boolean) Enable/Disable EKS control plane logging to CloudWatch (default `false`).
 - `endpoints` (Attributes List) AWS environment VPC endpoint configuration (see [below for nested schema](#nestedatt--endpoints))
 - `external_buckets` (Attributes Set) List of external S3 buckets to allow access to.
@@ -900,6 +984,15 @@ Optional:
 - `metrics_enabled` (Boolean) Set to `true` to enable ClickHouse metrics collection, `false` otherwise (default `false`).
 
 
+<a id="nestedatt--eks_access_entries"></a>
+### Nested Schema for `eks_access_entries`
+
+Required:
+
+- `access_level` (String) Access granted to the principal: `ADMIN` (full cluster administration), `READ_WRITE` (read and write access to namespaced resources) or `READ_ONLY`.
+- `principal_arn` (String) ARN of the IAM role or user to grant access to.
+
+
 <a id="nestedatt--endpoints"></a>
 ### Nested Schema for `endpoints`
 

examples/resources/altinitycloud_env_aws/eks-access-entries/main.tf

@@ -0,0 +1,75 @@
+resource "altinitycloud_env_certificate" "this" {
+  env_name = "acme-staging"
+}
+
+locals {
+  zones = ["us-east-1a", "us-east-1b"]
+}
+
+provider "aws" {
+  region = "us-east-1"
+}
+
+module "altinitycloud_connect_aws" {
+  source = "altinity/connect-aws/altinitycloud"
+  pem    = altinitycloud_env_certificate.this.pem
+}
+
+resource "altinitycloud_env_aws" "this" {
+  name           = altinitycloud_env_certificate.this.env_name
+  aws_account_id = "123456789012"
+  region         = "us-east-1"
+  zones          = local.zones
+  cidr           = "10.67.0.0/21"
+  load_balancers = {
+    public = {
+      enabled          = true
+      source_ip_ranges = ["0.0.0.0/0"]
+    }
+  }
+  node_groups = [
+    {
+      node_type         = "t4g.large"
+      capacity_per_zone = 10
+      zones             = local.zones
+      reservations      = ["SYSTEM", "ZOOKEEPER"]
+    },
+    {
+      node_type         = "m6i.large"
+      capacity_per_zone = 10
+      zones             = local.zones
+      reservations      = ["CLICKHOUSE"]
+    }
+  ]
+
+  // IAM principals from your own account that can reach the EKS Kubernetes API.
+  // The list is authoritative: entries removed here are revoked on the next apply.
+  eks_access_entries = [
+    {
+      principal_arn = "arn:aws:iam::123456789012:role/platform-admin"
+      access_level  = "ADMIN"
+    },
+    {
+      principal_arn = "arn:aws:iam::123456789012:role/platform-oncall"
+      access_level  = "READ_WRITE"
+    },
+    {
+      principal_arn = "arn:aws:iam::123456789012:user/auditor"
+      access_level  = "READ_ONLY"
+    }
+  ]
+
+  cloud_connect = true
+  depends_on = [
+    // "depends_on" is here to enforce "this resource, then altinitycloud_connect_aws" order on destroy.
+    module.altinitycloud_connect_aws
+  ]
+}
+
+// ⚠️ Environment provisioning is asynchronous.
+// Without this data source, Terraform cannot detect provisioning failures.
+// This data source waits until the environment is fully reconciled and reports errors.
+data "altinitycloud_env_aws_status" "this" {
+  name                           = altinitycloud_env_aws.this.name
+  wait_for_applied_spec_revision = altinitycloud_env_aws.this.spec_revision
+}

internal/provider/common/docs.go

@@ -319,6 +319,16 @@ const DATADOG_METRICS_ENABLED_DESCRIPTION = "Set to `true` to enable ClickHouse
 // EKS Logging descriptions.
 const EKS_LOGGING_DESCRIPTION = "Enable/Disable EKS control plane logging to CloudWatch (default `false`)."
 
+// EKS access entry descriptions.
+const EKS_ACCESS_ENTRIES_DESCRIPTION = `IAM principals granted access to the environment's EKS API (Kubernetes API server). Up to 8 entries.
+
+		The list is authoritative: updating it replaces the entries currently configured, and removing the attribute revokes every entry the provider manages.
+
+		AWS rejects service-linked roles (` + "`arn:aws:iam::123456789012:role/aws-service-role/...`" + `) as EKS access entry principals.
+`
+const EKS_ACCESS_ENTRY_PRINCIPAL_ARN_DESCRIPTION = "ARN of the IAM role or user to grant access to."
+const EKS_ACCESS_ENTRY_ACCESS_LEVEL_DESCRIPTION = "Access granted to the principal: `ADMIN` (full cluster administration), `READ_WRITE` (read and write access to namespaced resources) or `READ_ONLY`."
+
 // Status verbose descriptions.
 const VERBOSE_DESCRIPTION = "When enabled, prints real-time provisioning progress to the terminal (default `true`). Disable in CI/CD or non-interactive environments."
 

internal/provider/env/aws/e2e_test.go

@@ -117,6 +117,17 @@ resource "%s" "dummy" {
     name = "my-external-bucket"
   }]
 
+  eks_access_entries = [
+    {
+      principal_arn = "arn:aws:iam::123456789012:role/platform-admin"
+      access_level  = "ADMIN"
+    },
+    {
+      principal_arn = "arn:aws:iam::123456789012:role/platform-reader"
+      access_level  = "READ_ONLY"
+    },
+  ]
+
   backups = {
     custom_bucket = {
       name     = "my-backup-bucket"

internal/provider/env/aws/model.go

@@ -37,6 +37,7 @@ type AWSEnvModel struct {
 	MetricsEndpoint              *common.MetricsEndpointModel    `tfsdk:"metrics_endpoint"`
 	Datadog                      *common.DatadogModel            `tfsdk:"datadog"`
 	EksLogging                   types.Bool                      `tfsdk:"eks_logging"`
+	EksAccessEntries             []AWSEnvEKSAccessEntryModel     `tfsdk:"eks_access_entries"`
 
 	SpecRevision                 types.Int64 `tfsdk:"spec_revision"`
 	ForceDestroy                 types.Bool  `tfsdk:"force_destroy"`
@@ -91,6 +92,11 @@ type AWSEnvExternalBucketModel struct {
 	KmsKeyArn types.String `tfsdk:"kms_key_arn"`
 }
 
+type AWSEnvEKSAccessEntryModel struct {
+	PrincipalArn types.String `tfsdk:"principal_arn"`
+	AccessLevel  types.String `tfsdk:"access_level"`
+}
+
 type AWSEnvBackupsModel struct {
 	CustomBucket *AWSEnvCustomBucketModel `tfsdk:"custom_bucket"`
 }
@@ -164,6 +170,14 @@ func (e AWSEnvModel) toSDK(ctx context.Context) (sdk.CreateAWSEnvInput, sdk.Upda
 		})
 	}
 
+	var eksAccessEntries []*sdk.AWSEnvEKSAccessEntrySpecInput
+	for _, a := range e.EksAccessEntries {
+		eksAccessEntries = append(eksAccessEntries, &sdk.AWSEnvEKSAccessEntrySpecInput{
+			PrincipalArn: a.PrincipalArn.ValueString(),
+			AccessLevel:  sdk.AWSEnvEKSAccessLevel(a.AccessLevel.ValueString()),
+		})
+	}
+
 	backups := backupsToSDK(e.Backups)
 	maintenanceWindows := common.MaintenanceWindowsToSDK(e.MaintenanceWindows)
 	LoadBalancers := loadBalancersToSDK(e.LoadBalancers)
@@ -205,6 +219,7 @@ func (e AWSEnvModel) toSDK(ctx context.Context) (sdk.CreateAWSEnvInput, sdk.Upda
 			MetricsEndpoint:              metricsEndpoint,
 			Datadog:                      datadog,
 			EksLogging:                   e.EksLogging.ValueBoolPointer(),
+			EksAccessEntries:             eksAccessEntries,
 		},
 	}
 
@@ -231,6 +246,7 @@ func (e AWSEnvModel) toSDK(ctx context.Context) (sdk.CreateAWSEnvInput, sdk.Upda
 			MetricsEndpoint:       metricsEndpoint,
 			Datadog:               datadog,
 			EksLogging:            e.EksLogging.ValueBoolPointer(),
+			EksAccessEntries:      eksAccessEntries,
 		},
 	}
 
@@ -316,6 +332,14 @@ func (model *AWSEnvModel) toModel(env sdk.GetAWSEnv_AWSEnv) diag.Diagnostics {
 		})
 	}
 
+	var eksAccessEntries []AWSEnvEKSAccessEntryModel
+	for _, a := range env.Spec.EksAccessEntries {
+		eksAccessEntries = append(eksAccessEntries, AWSEnvEKSAccessEntryModel{
+			PrincipalArn: types.StringValue(a.PrincipalArn),
+			AccessLevel:  types.StringValue(string(a.AccessLevel)),
+		})
+	}
+
 	reorderIceberg(model.Iceberg, env.Spec.Iceberg)
 
 	backups := backupsToModel(env.Spec.Backups)
@@ -330,6 +354,7 @@ func (model *AWSEnvModel) toModel(env sdk.GetAWSEnv_AWSEnv) diag.Diagnostics {
 	model.SpecRevision = types.Int64Value(env.SpecRevision)
 	model.CloudConnect = types.BoolValue(env.Spec.CloudConnect)
 	model.EksLogging = types.BoolValue(env.Spec.EksLogging)
+	model.EksAccessEntries = eksAccessEntries
 	model.MetricsEndpoint = common.MetricsEndpointToModel(model.MetricsEndpoint, env.Spec.MetricsEndpoint.Enabled, env.Spec.MetricsEndpoint.SourceIPRanges)
 	model.Datadog = common.DatadogToModel(model.Datadog, env.Spec.Datadog.Enabled, env.Spec.Datadog.Domain, env.Spec.Datadog.LogsEnabled, env.Spec.Datadog.MetricsEnabled)