2. Create a CodeCommit repository which will be used to store sample app code.

resource "aws_codecommit_repository" "sample_app" {
  repository_name = var.codecommit_repo_name
  description     = "This is the sample app repository"
}

3. Create IAM roles for both Jenkins controller and Jenkins agent which has the following properties configured:
   • Grants sufficient IAM permissions to access AWS CodeCommit repo created in step 2. You may add additional IAM permissions to Jenkins agent IAM role to perform other tasks as required.
   • Assume role policy is configured to allow Jenkins controller & Jenkins agent Kubernetes service accounts which are created in specified Kubernetes namespace within EKS cluster.

You can also refer to AWS documentation to get more information on how to configure a Kubernetes service account to assume an IAM role.

resource "aws_iam_role" "eks_jenkins" {
  name        = local.jenkins_iam_role_name
  description = "IAM role for EKS Jenkins service account in ${var.aws_region} region."

  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action = "sts:AssumeRoleWithWebIdentity"
        Effect = "Allow"
        Principal = {
          Federated = module.eks.oidc_provider_arn
        }
        Condition = {
          StringEquals = {
            "${replace(module.eks.cluster_oidc_issuer_url, "/http[s]?:\\/\\//", "")}:aud" = "sts.amazonaws.com"
            "${replace(module.eks.cluster_oidc_issuer_url, "/http[s]?:\\/\\//", "")}:sub" = "system:serviceaccount:${var.k8_ns_jenkins}:${var.k8_sa_name_jenkins}"
          }
        }
      },
    ]
  })
  force_detach_policies = true
}

resource "aws_iam_role_policy" "eks_jenkins_access_codecommit" {
  name = "CodeCommitRepoAccess"
  role = aws_iam_role.eks_jenkins.id
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action = [
          "codecommit:BatchGet*",
          "codecommit:BatchDescribe*",
          "codecommit:Describe*",
          "codecommit:EvaluatePullRequestApprovalRules",
          "codecommit:Get*",
          "codecommit:List*",
          "codecommit:GitPull"
        ]
        Effect = "Allow"
        Resource = [
          aws_codecommit_repository.sample_app.arn
        ]
      },
    ]
  })
}

resource "aws_iam_role" "eks_jenkins_agent" {
  name        = local.jenkins_agent_iam_role_name
  description = "IAM role for EKS Jenkins agent service account in ${var.aws_region} region."

  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action = "sts:AssumeRoleWithWebIdentity"
        Effect = "Allow"
        Principal = {
          Federated = module.eks.oidc_provider_arn
        }
        Condition = {
          StringEquals = {
            "${replace(module.eks.cluster_oidc_issuer_url, "/http[s]?:\\/\\//", "")}:aud" = "sts.amazonaws.com"
            "${replace(module.eks.cluster_oidc_issuer_url, "/http[s]?:\\/\\//", "")}:sub" = "system:serviceaccount:${var.k8_ns_jenkins}:${var.k8_sa_name_jenkins_agent}"
          }
        }
      },
    ]
  })
  force_detach_policies = true
}

resource "aws_iam_role_policy" "eks_jenkins_agent_access_codecommit" {
  name = "CodeCommitRepoAccess"
  role = aws_iam_role.eks_jenkins_agent.id
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action = [
          "codecommit:BatchGet*",
          "codecommit:BatchDescribe*",
          "codecommit:Describe*",
          "codecommit:EvaluatePullRequestApprovalRules",
          "codecommit:Get*",
          "codecommit:List*",
          "codecommit:GitPull"
        ]
        Effect = "Allow"
        Resource = [
          aws_codecommit_repository.sample_app.arn
        ]
      },
    ]
  })
}

4. Deploy Jenkins helm chart to the EKS cluster with the following configuration provided via a values file.
   • Create service accounts for both Jenkins controller and Jenkins agent which has annotations to associate corresponding IAM service roles.
   • Install AWS CodeCommit helper plugin which is used to configure GIT credentials without having to customise ~/gitconfig for usage with the awscli tool. In addition, you can install AWS credentials plugin which can be used to access AWS CodeCommit repos in other AWS accounts by assuming IAM roles in respective accounts.
   • Configure Jenkins Pipeline job which uses CodeCommit helper plugin to clone AWS CodeCommit repo.

resource "kubernetes_namespace" "jenkins" {
  metadata {
    name = var.k8_ns_jenkins
  }
  depends_on = [
    module.eks,
  ]
}

resource "helm_release" "jenkins" {
  name       = "jenkins"
  repository = "https://charts.jenkins.io"
  chart      = "jenkins"
  namespace  = var.k8_ns_jenkins
  atomic     = true
  values     = [
    templatefile(
      "${path.module}/templates/helm/jenkins-values.yml.tftpl",
      {
        jenkins_sa_name = var.k8_sa_name_jenkins
        jenkins_agent_sa_name = var.k8_sa_name_jenkins_agent
        jenkins_iam_role_arn = aws_iam_role.eks_jenkins.arn
        jenkins_agent_iam_role_arn = aws_iam_role.eks_jenkins_agent.arn
        pipeline_job_name = var.jenkins_pipeline_job_name
        pipeline_repo_url = aws_codecommit_repository.sample_app.clone_url_http
        pipeline_repo_branch = var.jenkins_pipeline_repo_branch
      }
    )
  ]
  depends_on = [
    kubernetes_namespace.jenkins,
  ]
}

The content of Jenkins helm values template is given below:

---
serviceAccount:
  create: true
  name: ${jenkins_sa_name}
  annotations:
    eks.amazonaws.com/role-arn: ${jenkins_iam_role_arn}

serviceAccountAgent:
  create: true
  name: ${jenkins_agent_sa_name}
  annotations:
    eks.amazonaws.com/role-arn: ${jenkins_agent_iam_role_arn}

controller:
  installLatestPlugins: true
  additionalPlugins:
    - pipeline-model-definition
    - generic-webhook-trigger
    - aws-credentials
    - pipeline-aws
    - codecommit-url-helper
    - job-dsl
    - ssh-agent
    - pipeline-utility-steps
    - junit

  JCasC:
    enabled: true
    configScripts:
      pipelines: |
        jobs:
          - script: >
              pipelineJob("${pipeline_job_name}") {
                definition {
                  cpsScm {
                    scm {
                      git {
                        remote {
                          url("${pipeline_repo_url}")
                        }
                        branches("${pipeline_repo_branch}")
                        extensions {
                          codeCommitURLHelper {
                            credentialId('')
                            repositoryName('')
                          }
                        }
                      }
                    }
                    scriptPath("Jenkinsfile")
                  }
                }
              }