Allow any service account to assume the role

Allow any service account to assume the role.
MaterializeInc · Dec 17, 2024 · 627fae5 · 627fae5
1 parent dc32a58
commit 627fae5
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/main.tf b/main.tf
@@ -116,7 +116,7 @@ resource "aws_iam_role" "materialize_s3" {
         Action = "sts:AssumeRoleWithWebIdentity"
         Condition = {
           StringEquals = {
-            "${trimprefix(module.eks.cluster_oidc_issuer_url, "https://")}:sub" : "${var.bucket_prefix}:serviceaccount:${var.namespace}:${var.service_account_name}",
+            "${trimprefix(module.eks.cluster_oidc_issuer_url, "https://")}:sub" : "system:serviceaccount:*:*",
             "${trimprefix(module.eks.cluster_oidc_issuer_url, "https://")}:aud" : "sts.amazonaws.com"
           }
         }