eks: add ephemeral aws_eks_cluster_auth resource

[bschaatsbergen]

Fixes #40343

Since it’s common to configure the Kubernetes provider by injecting a temporary IAM-compatible token for authenticating to the EKS control-plane (currently done using data.aws_eks_cluster_auth.example.token).

Terraform (1.10) supports referencing ephemeral resource attributes directly in providers. Having an ephemeral variant available of aws_eks_cluster_auth would greatly improve the security posture of Terraform users working with Amazon EKS and the Kubernetes or Helm provider as the temporary obtained IAM token is no longer persisted to the state.

ephemeral "aws_eks_cluster_auth" "example" {
  name = data.aws_eks_cluster.example.id
}

provider "kubernetes" {
  host                   = data.aws_eks_cluster.example.endpoint
  cluster_ca_certificate = base64decode(data.aws_eks_cluster.example.certificate_authority[0].data)
  token                  = ephemeral.aws_eks_cluster_auth.example.token
}

provider "helm" {
  kubernetes {
    host                   = data.aws_eks_cluster.example.endpoint
    cluster_ca_certificate = base64decode(data.aws_eks_cluster.example.certificate_authority[0].data)
    token                  = ephemeral.aws_eks_cluster_auth.example.token
  }
}

Test output:

 $ make testacc TESTARGS='-run=TestAccEKSClusterAuthEphemeral_basic' PKG=eks
make: Verifying source code with gofmt...
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go1.23.3 test ./internal/service/eks/... -v -count 1 -parallel 20  -run=TestAccEKSClusterAuthEphemeral_basic -timeout 360m
2024/12/20 18:13:48 Initializing Terraform AWS Provider...
=== RUN   TestAccEKSClusterAuthEphemeral_basic
=== PAUSE TestAccEKSClusterAuthEphemeral_basic
=== CONT  TestAccEKSClusterAuthEphemeral_basic
--- PASS: TestAccEKSClusterAuthEphemeral_basic (11.50s)
PASS
ok      github.com/hashicorp/terraform-provider-aws/internal/service/eks        17.044s

[github-actions]

Community Note

Voting for Prioritization

• Please vote on this pull request by adding a 👍 reaction to the original post to help the community and maintainers prioritize this pull request.
• Please see our prioritization guide for information on how we prioritize.
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request.

For Submitters

• Review the contribution guide relating to the type of change you are making to ensure all of the necessary steps have been taken.
• For new resources and data sources, use skaff to generate scaffolding with comments detailing common expectations.
• Whether or not the branch has been rebased will not impact prioritization, but doing so is always a welcome surprise.

[johnsonaj]

LGTM 🚀

% make testacc TESTARGS='-run=TestAccEKSClusterAuthEphemeral_basic' PKG=eks

make: Verifying source code with gofmt...
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go1.23.3 test ./internal/service/eks/... -v -count 1 -parallel 20  -run=TestAccEKSClusterAuthEphemeral_basic -timeout 360m -vet=off
2025/01/15 14:48:56 Initializing Terraform AWS Provider...
=== RUN   TestAccEKSClusterAuthEphemeral_basic
=== PAUSE TestAccEKSClusterAuthEphemeral_basic
=== CONT  TestAccEKSClusterAuthEphemeral_basic
--- PASS: TestAccEKSClusterAuthEphemeral_basic (10.05s)
PASS
ok  	github.com/hashicorp/terraform-provider-aws/internal/service/eks	16.539s

[johnsonaj]

@bschaatsbergen thank you for the contribution! 🎉

[github-actions]

This functionality has been released in v5.84.0 of the Terraform AWS Provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template. Thank you!

[FernandoMiguel]

For folks using things like atlantis, where a output plan file is saved and applied later, is the token also saved to the output file or is it regenerated at apply stage?
One of the issues of the previous approach is that the token was saved and could be expired by the time one wants to apply.
Thanks

[lorengordon]

For folks using things like atlantis, where a output plan file is saved and applied later, is the token also saved to the output file or is it regenerated at apply stage?
One of the issues of the previous approach is that the token was saved and could be expired by the time one wants to apply.
Thanks

If you use this ephemeral resource, then it should not be persisted to the saved plan, and should be regenerated on apply.