fix: Eliminates depends_on in policy association using ref to access entry

[lorengordon]

Description

By using a reference to the eks_access_entry resource, we can eliminate the depends_on in the aws_access_entry_policy_association resource.

Motivation and Context

Using depends_on is generally frowned on, and can cause odd errors for some terraform operations, especially resource recreating operations. In our case, we were running into problems when refactoring resulted in recreating access entries and policy associations for the same principal. Using a attribute ref helped terraform create the graph properly for more types of operations.

Breaking Changes

None.

How Has This Been Tested?

• I have tested and validated these changes using one or more of the provided examples/* projects

• I have executed pre-commit run -a on my pull request

[lorengordon]

terraform-aws-eks/examples/eks-auto-mode > terraform apply -auto-approve
...
module.eks.aws_eks_access_entry.this["cluster_creator"]: Creating...
module.eks.aws_eks_access_entry.this["cluster_creator"]: Creation complete after 0s
module.eks.aws_eks_access_policy_association.this["cluster_creator_admin"]: Creating...
module.eks.aws_eks_access_policy_association.this["cluster_creator_admin"]: Creation complete after 1s
...
module.eks_auto_custom_node_pools.aws_eks_access_entry.this["cluster_creator"]: Creating...
module.eks_auto_custom_node_pools.aws_eks_access_entry.this["cluster_creator"]: Creation complete after 0s
module.eks_auto_custom_node_pools.aws_eks_access_policy_association.this["cluster_creator_admin"]: Creating...
module.eks_auto_custom_node_pools.aws_eks_access_policy_association.this["cluster_creator_admin"]: Creation complete after 1s
...
Apply complete! Resources: 106 added, 0 changed, 0 destroyed.

[github-actions]

This PR has been automatically marked as stale because it has been open 30 days
with no activity. Remove stale label or comment or this PR will be closed in 10 days

[lorengordon]

Not stale

[bryantbiggs]

we are unlikely to accept the change as is - its written correctly and this would technically be a breaking change. what issue are you encountering?

[lorengordon]

There is no breaking change here that I can tell. What are you seeing when you run it that makes it breaking?

[bryantbiggs]

it assumes principal_arn is always created by this module and never user provided

[lorengordon]

Hmm, are you sure? When I traced through the inputs, looking for principal_arn references before submitting, I checked for that. I am pretty sure the principal_arn is always user provided, except for the cluster_creator entry. But even the cluster_creator entry is still a principal that already exists, since it is the principal executing terraform.

Edit: Yeah, other than cluster_creator, all access entry objects are defined via the var.access_entries input,

terraform-aws-eks/main.tf

Line 273 in 42693d4

var.access_entries,

[github-actions]

This PR has been automatically marked as stale because it has been open 30 days
with no activity. Remove stale label or comment or this PR will be closed in 10 days

[lorengordon]

Not stale

[github-actions]

This PR has been automatically marked as stale because it has been open 30 days
with no activity. Remove stale label or comment or this PR will be closed in 10 days