eks: add ephemeral aws_eks_cluster_auth resource

[bschaatsbergen]

Fixes #40343

Since it’s common to configure the Kubernetes provider by injecting a temporary IAM-compatible token for authenticating to the EKS control-plane (currently done using data.aws_eks_cluster_auth.example.token).

Terraform (1.10) supports referencing ephemeral resource attributes directly in providers. Having an ephemeral variant available of aws_eks_cluster_auth would greatly improve the security posture of Terraform users working with Amazon EKS and the Kubernetes or Helm provider as the temporary obtained IAM token is no longer persisted to the state.

ephemeral "aws_eks_cluster_auth" "example" {
  name = data.aws_eks_cluster.example.id
}

provider "kubernetes" {
  host                   = data.aws_eks_cluster.example.endpoint
  cluster_ca_certificate = base64decode(data.aws_eks_cluster.example.certificate_authority[0].data)
  token                  = ephemeral.aws_eks_cluster_auth.example.token
}

provider "helm" {
  kubernetes {
    host                   = data.aws_eks_cluster.example.endpoint
    cluster_ca_certificate = base64decode(data.aws_eks_cluster.example.certificate_authority[0].data)
    token                  = ephemeral.aws_eks_cluster_auth.example.token
  }
}

Test output:

 $ make testacc TESTARGS='-run=TestAccEKSClusterAuthEphemeral_basic' PKG=eks
make: Verifying source code with gofmt...
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go1.23.3 test ./internal/service/eks/... -v -count 1 -parallel 20  -run=TestAccEKSClusterAuthEphemeral_basic -timeout 360m
2024/12/20 18:13:48 Initializing Terraform AWS Provider...
=== RUN   TestAccEKSClusterAuthEphemeral_basic
=== PAUSE TestAccEKSClusterAuthEphemeral_basic
=== CONT  TestAccEKSClusterAuthEphemeral_basic
--- PASS: TestAccEKSClusterAuthEphemeral_basic (11.50s)
PASS
ok      github.com/hashicorp/terraform-provider-aws/internal/service/eks        17.044s

[github-actions]

Community Note

Voting for Prioritization

• Please vote on this pull request by adding a 👍 reaction to the original post to help the community and maintainers prioritize this pull request.
• Please see our prioritization guide for information on how we prioritize.
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request.

For Submitters

• Review the contribution guide relating to the type of change you are making to ensure all of the necessary steps have been taken.
• For new resources and data sources, use skaff to generate scaffolding with comments detailing common expectations.
• Whether or not the branch has been rebased will not impact prioritization, but doing so is always a welcome surprise.

[johnsonaj]

LGTM 🚀

% make testacc TESTARGS='-run=TestAccEKSClusterAuthEphemeral_basic' PKG=eks

make: Verifying source code with gofmt...
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go1.23.3 test ./internal/service/eks/... -v -count 1 -parallel 20  -run=TestAccEKSClusterAuthEphemeral_basic -timeout 360m -vet=off
2025/01/15 14:48:56 Initializing Terraform AWS Provider...
=== RUN   TestAccEKSClusterAuthEphemeral_basic
=== PAUSE TestAccEKSClusterAuthEphemeral_basic
=== CONT  TestAccEKSClusterAuthEphemeral_basic
--- PASS: TestAccEKSClusterAuthEphemeral_basic (10.05s)
PASS
ok  	github.com/hashicorp/terraform-provider-aws/internal/service/eks	16.539s

[johnsonaj]

@bschaatsbergen thank you for the contribution! 🎉