feat(iam): add cloudwatch IAM module for the logs controller

[davidf-null]

What

New module infrastructure/aws/iam/cloudwatch that provisions the IAM role + policy the nullplatform logs controller uses to ship logs and metrics to CloudWatch. Supports both IRSA (OIDC federation) and EKS Pod Identity, following the same convention as iam/external_dns and iam/cert_manager.

Why

The base chart's logs controller runs under nullplatform-pod-metadata-reader-sa. To reach CloudWatch without granting permissions to the node instance role, it needs a scoped IAM role bound to that ServiceAccount. This module creates it; its nullplatform_cloudwatch_role_arn output feeds the base module's cloudwatch_service_account_annotations (added in #441).

Permissions

• logs:CreateLogGroup/CreateLogStream/PutLogEvents/PutRetentionPolicy/DescribeLogStreams/TagResource/ListTagsForResource — scoped to log_group_arn_patterns (default: any log group in the account/region; tightenable to a prefix)
• logs:DescribeLogGroups — * (account-wide list)
• cloudwatch:PutMetricData — * (no resource-level support)

Usage

module "cloudwatch_iam" {
  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/cloudwatch?ref=<tag>"

  cluster_name                        = "your-cluster"
  aws_iam_openid_connect_provider_arn = module.eks.eks_oidc_provider_arn
}

module "base" {
  # ...
  cloudwatch_enabled = true
  cloudwatch_service_account_annotations = {
    "eks.amazonaws.com/role-arn" = module.cloudwatch_iam.nullplatform_cloudwatch_role_arn
  }
}

Testing

tofu test — 11 passed, 0 failed (IRSA + Pod Identity: naming convention, policy actions, log-group scoping, mode isolation, validations). tofu validate and tofu fmt clean.

Completes the CloudWatch-IRSA chain: helm-charts#157 (chart value) + tofu-modules#441 (base module passthrough, merged) + this module (the IAM role).

🤖 Generated with Claude Code