diff --git a/modules/karpenter/README.md b/modules/karpenter/README.md
index ad8dfcd979..f283b6e741 100644
--- a/modules/karpenter/README.md
+++ b/modules/karpenter/README.md
@@ -110,6 +110,7 @@ No modules.
| [aws_iam_policy.controller](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
| [aws_iam_role.controller](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |
| [aws_iam_role.node](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |
+| [aws_iam_role_policy.controller](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy) | resource |
| [aws_iam_role_policy_attachment.controller](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
| [aws_iam_role_policy_attachment.controller_additional](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
| [aws_iam_role_policy_attachment.node](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
@@ -139,6 +140,7 @@ No modules.
| [create\_instance\_profile](#input\_create\_instance\_profile) | Whether to create an IAM instance profile | `bool` | `false` | no |
| [create\_node\_iam\_role](#input\_create\_node\_iam\_role) | Determines whether an IAM role is created or to use an existing IAM role | `bool` | `true` | no |
| [create\_pod\_identity\_association](#input\_create\_pod\_identity\_association) | Determines whether to create pod identity association | `bool` | `true` | no |
+| [enable\_inline\_policy](#input\_enable\_inline\_policy) | Determines whether the controller policy is created as a standard IAM policy or inline IAM policy. This can be enabled when the error `LimitExceeded: Cannot exceed quota for PolicySize: 6144` is received since standard IAM policies have a limit of 6,144 characters versus an inline role policy's limit of 10,240 ([Reference](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_iam-quotas.html)) | `bool` | `false` | no |
| [enable\_spot\_termination](#input\_enable\_spot\_termination) | Determines whether to enable native spot termination handling | `bool` | `true` | no |
| [iam\_policy\_description](#input\_iam\_policy\_description) | IAM policy description | `string` | `"Karpenter controller IAM policy"` | no |
| [iam\_policy\_name](#input\_iam\_policy\_name) | Name of the IAM policy | `string` | `"KarpenterController"` | no |
diff --git a/modules/karpenter/main.tf b/modules/karpenter/main.tf
index 4d3cc08ed1..af0e947e76 100644
--- a/modules/karpenter/main.tf
+++ b/modules/karpenter/main.tf
@@ -70,8 +70,17 @@ resource "aws_iam_role" "controller" {
tags = merge(var.tags, var.iam_role_tags)
}
+resource "aws_iam_role_policy" "controller" {
+ count = local.create_iam_role && var.enable_inline_policy ? 1 : 0
+
+ name = var.iam_policy_use_name_prefix ? null : var.iam_policy_name
+ name_prefix = var.iam_policy_use_name_prefix ? "${var.iam_policy_name}-" : null
+ role = aws_iam_role.controller[0].name
+ policy = data.aws_iam_policy_document.controller[0].json
+}
+
resource "aws_iam_policy" "controller" {
- count = local.create_iam_role ? 1 : 0
+ count = local.create_iam_role && !var.enable_inline_policy ? 1 : 0
name = var.iam_policy_use_name_prefix ? null : var.iam_policy_name
name_prefix = var.iam_policy_use_name_prefix ? "${var.iam_policy_name}-" : null
@@ -83,7 +92,7 @@ resource "aws_iam_policy" "controller" {
}
resource "aws_iam_role_policy_attachment" "controller" {
- count = local.create_iam_role ? 1 : 0
+ count = local.create_iam_role && !var.enable_inline_policy ? 1 : 0
role = aws_iam_role.controller[0].name
policy_arn = aws_iam_policy.controller[0].arn
diff --git a/modules/karpenter/variables.tf b/modules/karpenter/variables.tf
index 6d3d042516..b814963485 100644
--- a/modules/karpenter/variables.tf
+++ b/modules/karpenter/variables.tf
@@ -32,6 +32,12 @@ variable "create_iam_role" {
default = true
}
+variable "enable_inline_policy" {
+ description = "Determines whether the controller policy is created as a standard IAM policy or inline IAM policy. This can be enabled when the error `LimitExceeded: Cannot exceed quota for PolicySize: 6144` is received since standard IAM policies have a limit of 6,144 characters versus an inline role policy's limit of 10,240 ([Reference](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_iam-quotas.html))"
+ type = bool
+ default = false
+}
+
variable "iam_role_name" {
description = "Name of the IAM role"
type = string