[wip] access boskos accounts via IAM roles

infra/aws/terraform/boskos/boskos/main.tf

@@ -0,0 +1,61 @@
+resource "aws_iam_openid_connect_provider" "eks_build_cluster" {
+  url             = "https://oidc.eks.us-east-2.amazonaws.com/id/F8B73554FE6FBAF9B19569183FB39762"
+  client_id_list  = ["sts.amazonaws.com"]
+  thumbprint_list = ["06b25927c42a721631c1efd9431e648fa62e1e39"]
+}
+
+resource "aws_iam_openid_connect_provider" "gke_build_cluster" {
+  url             = "https://container.googleapis.com/v1/projects/k8s-infra-prow-buildlocations/us-central1/clusters/prow-build"
+  client_id_list  = ["sts.amazonaws.com"]
+  thumbprint_list = ["08745487e891c19e3078c1f2a07e452950ef36f6"]
+}
+
+resource "aws_iam_role" "boskos" {
+  name = "boskos"
+  assume_role_policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        "Effect" : "Allow",
+        "Principal" : {
+          "Federated" : aws_iam_openid_connect_provider.eks_build_cluster.arn
+        },
+        "Action" : "sts:AssumeRoleWithWebIdentity",
+        "Condition" : {
+          "StringEquals" : {
+            "oidc.eks.us-east-2.amazonaws.com/id/F8B73554FE6FBAF9B19569183FB39762:sub" : [
+              "system:serviceaccount:test-pods:boskos",
+              "system:serviceaccount:test-pods:default"
+            ]
+          }
+        }
+      },
+      {
+        "Effect" : "Allow",
+        "Principal" : {
+          "Federated" : aws_iam_openid_connect_provider.gke_build_cluster.arn
+        },
+        "Action" : "sts:AssumeRoleWithWebIdentity",
+        "Condition" : {
+          "StringEquals" : {
+            "container.googleapis.com/v1/projects/k8s-infra-prow-build/locations/us-central1/clusters/prow-build:sub" : [
+              "system:serviceaccount:test-pods:boskos",
+              "system:serviceaccount:test-pods:default"
+            ]
+          }
+        }
+      }
+    ]
+  })
+
+  max_session_duration = 43200
+}
+
+resource "aws_iam_role_policy_attachment" "boskos" {
+  role       = aws_iam_role.boskos.name
+  policy_arn = "arn:aws:iam::aws:policy/AdministratorAccess"
+}
+
+output "boskos_arn" {
+  value = aws_iam_role.boskos.arn
+}

infra/aws/terraform/boskos/main.tf

@@ -0,0 +1,31 @@
+/*
+Copyright 2026 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+
+module "scale_001" {
+  source = "./boskos"
+  providers = {
+    aws = aws.boskos-scale-001
+  }
+}
+
+locals {
+  accounts = {
+    boskos-001       = 995654820765
+    boskos-scale-001 = 226543828060
+    boskos-scale-002 = 405186867737
+  }
+}

infra/aws/terraform/boskos/provider.tf

@@ -0,0 +1,37 @@
+/*
+Copyright 2023 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+provider "aws" {
+  region = var.region
+}
+
+# Provider refering to eks-e2e-boskos-001 AWS account.
+# "provisioner" user in eks-e2e-boskos-001 account has permission to assume
+# the referenced role.
+provider "aws" {
+  region = var.region
+  alias  = "boskos-scale-001"
+  default_tags {
+    tags = {
+      Environment = "Production"
+      Shared      = "Ignore"
+    }
+  }
+  assume_role {
+    role_arn = "arn:aws:iam::${lookup(local.accounts, "boskos-scale-001")}:role/OrganizationAccountAccessRole"
+  }
+}
+

infra/aws/terraform/boskos/variables.tf

@@ -0,0 +1,20 @@
+/*
+Copyright 2023 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+variable "region" {
+  type    = string
+  default = "us-east-2"
+}

infra/aws/terraform/boskos/versions.tf

@@ -0,0 +1,20 @@
+terraform {
+  required_version = "~> 1.11"
+
+  backend "s3" {
+    # This S3 bucket is created in eks-e2e-boskos-001 AWS account
+    bucket = "eks-e2e-boskos-tfstate"
+    key    = "boskos/terraform.tfstate"
+    region = "us-west-2"
+    assume_role = {
+      role_arn = "arn:aws:iam::995654820765:role/OrganizationAccountAccessRole"
+    }
+  }
+
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~> 6.28"
+    }
+  }
+}

infra/aws/terraform/management-account/organization-accounts-boskos.tf

@@ -18,6 +18,30 @@ limitations under the License.
 # Accounts used by boskos in the EKS cluster #
 ##############################################
 
+// This account holds the terraform state and other boskos related resource we don't want 
+// e2e to access
+module "k8s_infra_eks_e2e_boskos_001" {
+  source = "../modules/org-account"
+
+  account_name               = "k8s-infra-eks-e2e-boskos-mgmt"
+  email                      = "k8s-infra-aws-admins+k8s-infra-eks-e2e-boskos-mgmt@kubernetes.io"
+  iam_user_access_to_billing = "ALLOW"
+  parent_id                  = aws_organizations_organizational_unit.boskos.id
+  permissions_map = {
+    "boskos-admin" = [
+      "AdministratorAccess",
+    ]
+  }
+
+  tags = {
+    "production"  = "true",
+    "environment" = "prod",
+    "group"       = "sig-k8s-infra",
+    "service"     = "boskos"
+  }
+}
+
+
 module "k8s_infra_eks_e2e_boskos_001" {
   source = "../modules/org-account"