Terraform AWS EKS Module v21.29.0: Opt-In aws:SourceArn Condition for Karpenter IAM Trust Policy

Introduction

terraform-aws-modules/terraform-aws-eks v21.29.0 was released on 2026-10-07. This is a small, single-feature release focused on hardening the IAM trust policy used by the module's Karpenter controller role. If the project uses this module to provision Karpenter on EKS, this release is worth a quick look even though the changelog is short.

Release page: https://github.com/terraform-aws-modules/terraform-aws-eks/releases/tag/v21.29.0

What Is New

The only documented change in this release is:

• Opt-in aws:SourceArn condition on the Karpenter controller IAM role trust policy (#3743, commit 87db059).

In practice, this means the module can now add an aws:SourceArn condition key to the trust policy statement that allows a principal (typically the OIDC provider or Pod Identity association) to assume the Karpenter controller role. This type of condition is a standard mitigation for the "confused deputy" problem: it restricts which exact source ARN (for example, a specific OIDC provider or Pod Identity association ARN) is allowed to assume the role, rather than trusting any caller that satisfies the broader federation condition.

A trust policy statement with this condition looks like this once applied:

data "aws_iam_policy_document" "karpenter_controller_assume_role" {
  statement {
    actions = ["sts:AssumeRoleWithWebIdentity"]
    effect  = "Allow"
 
    principals {
      type        = "Federated"
      identifiers = [module.eks.oidc_provider_arn]
    }
 
    condition {
      test     = "StringEquals"
      variable = "${module.eks.oidc_provider}:sub"
      values   = ["system:serviceaccount:karpenter:karpenter"]
    }
 
    condition {
      test     = "ArnEquals"
      variable = "aws:SourceArn"
      values   = [module.eks.oidc_provider_arn]
    }
  }
}

The release notes do not spell out the exact input variable name used to enable this behavior in the Karpenter submodule, nor do they indicate a default value. Because the feature is described as opt-in, existing configurations should not see a behavior change on upgrade unless the new flag is explicitly set. Before relying on the example above in production, check the Karpenter submodule source or variables.tf in the v21.29.0 tag for the precise variable name, since the changelog entry itself does not list it.

No deprecations, breaking changes, or other features are listed for this release.

Upgrade Steps

Pin the module version explicitly and run a standard upgrade:

module "eks" {
  source  = "terraform-aws-modules/eks/aws"
  version = "~> 21.29"
 
  # existing configuration unchanged
}

terraform init -upgrade
terraform plan

Because the new condition is opt-in, terraform plan should show no changes to the Karpenter IAM role trust policy for existing configurations that do not set the new flag. If the plan does show a diff on the Karpenter controller role's assume_role_policy, review it carefully before applying, since it affects which principals can assume that role.

Verify

After applying, confirm the trust policy on the Karpenter controller role:

aws iam get-role \
  --role-name <karpenter-controller-role-name> \
  --query 'Role.AssumeRolePolicyDocument' \
  --output json

Check whether an aws:SourceArn condition is present in the returned trust policy if the new opt-in flag was enabled, and confirm Karpenter pods can still assume the role by checking the Karpenter controller logs or pod status:

kubectl -n karpenter logs deploy/karpenter --tail=50

Conclusion

v21.29.0 is a narrowly scoped, security-focused release: it adds an opt-in aws:SourceArn condition to the Karpenter controller IAM role trust policy to reduce the attack surface of role assumption. Teams running Karpenter via this module should upgrade, run terraform plan to confirm no unexpected trust-policy drift, and consider enabling the new condition after confirming the exact variable name in the module source for v21.29.0. For teams not using the Karpenter submodule, this release has no practical impact.