How to configure Read access

PROFILE=
POLICY=arn:aws:iam::aws:policy/CloudWatchAgentServerPolicy
USE_IAM_SERVICE_ACCOUNTS=
LOG_RETENTION_DAYS=7

if [ -z "$REGION" ]
then
    region_arg=""
else
    region_arg="--region $REGION"
fi

if [ -z "$PROFILE" ]
then
    profile_arg=""
else
    profile_arg="--profile $PROFILE"
fi

aws_version=$(aws --version | cut -d " " -f1 | cut -d/ -f2)
aws_major_version=$(echo $aws_version | cut -d. -f1)
aws_minor_version=$(echo $aws_version | cut -d. -f2)
if [ $aws_major_version -lt 2 ] || [ $aws_major_version -eq 2 ] && [ $aws_minor_version -lt 8 ]
then
    echo "WARNING: Outdated AWS CLI version detected - $aws_version, the script might fail."
    echo "Follow these instructions to update your AWS CLI version: https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html#getting-started-install-instructions"
fi

if [ -z "$USE_IAM_SERVICE_ACCOUNTS" ]
then
    node_roles=()

    echo "Fetch node IAM roles from EKS Nodegroups"
    node_groups=$(aws eks list-nodegroups --cluster-name $CLUSTER $region_arg $profile_arg --query "nodegroups" --output text)
    for node_group in ${node_groups[@]}; do
        node_role=$(aws eks describe-nodegroup --cluster-name $CLUSTER $region_arg $profile_arg --nodegroup-name $node_group --query "nodegroup.nodeRole" --output text)
        node_roles+=($node_role)
    done

    echo "Fetch node IAM instance roles from EC2 instances"
    ec2_instance_profile_ids=($(aws ec2 describe-instances $region_arg $profile_arg --filter Name=tag-key,Values=kubernetes.io/cluster/$CLUSTER --query "Reservations[*].Instances[*].IamInstanceProfile.Id" --output text | sed 's/\s/\n/g' | sed -r '/^\s*$/d' | sort -u))
    for profile_id in ${ec2_instance_profile_ids[@]}; do
        echo "Fetch node IAM roles for EC2 instance profile with ID $profile_id"
        instance_roles=$(aws iam list-instance-profiles $profile_arg --query "InstanceProfiles[?InstanceProfileId=='$profile_id'].Roles[*].Arn" --output text)
        node_roles+=(${instance_roles[@]})
    done

    echo "Fetch node IAM instance profiles from auto-scaling groups"
    lt_instance_profile_names=()
    launch_template_ids=($(aws autoscaling describe-auto-scaling-groups $region_arg $profile_arg --filter Name=tag-key,Values=kubernetes.io/cluster/$CLUSTER --query "AutoScalingGroups[*].MixedInstancesPolicy.LaunchTemplate.LaunchTemplateSpecification.LaunchTemplateId" --output text | sed 's/\s/\n/g' | sed -r '/^\s*$/d' | sort -u))
    launch_template_ids+=($(aws autoscaling describe-auto-scaling-groups $region_arg $profile_arg --filter Name=tag-key,Values=kubernetes.io/cluster/$CLUSTER --query "AutoScalingGroups[*].LaunchTemplate.LaunchTemplateId" --output text | sed 's/\s/\n/g' | sed -r '/^\s*$/d' | sort -u))
    for launch_template_id in ${launch_template_ids[@]}; do
        lt_instance_profile_names+=($(aws ec2 describe-launch-template-versions $region_arg $profile_arg --launch-template-id ${launch_template_id} --versions $Default $Latest --query "LaunchTemplateVersions[*].LaunchTemplateData.IamInstanceProfile.Name" --output text | sed 's/\s/\n/g' | sort -u))
    done
    for profile_name in ${lt_instance_profile_names[@]}; do
        echo "Fetch node IAM roles for EC2 instance profile named $profile_name"
        instance_roles=$(aws iam list-instance-profiles $profile_arg --query "InstanceProfiles[?InstanceProfileName=='$profile_name'].Roles[*].Arn" --output text)
        node_roles+=(${instance_roles[@]})
    done

    unique_node_roles=($(for role in "${node_roles[@]}"; do echo "${role}"; done | sort -u))
    for node_role in ${unique_node_roles[@]}; do
        role_name="${node_role#*/}"
        echo "Attach IAM policy $POLICY to role $role_name"
        aws iam attach-role-policy \
            --policy-arn $POLICY \
            --role-name $role_name \
            $profile_arg
    done
else
    echo "Check if the cluster has an ODIC provider."
    oidc_id=$(aws eks describe-cluster --name $CLUSTER $region_arg $profile_arg --query "cluster.identity.oidc.issuer" --output text | cut -d '/' -f 5)
    
    if [[ $(aws iam list-open-id-connect-providers | grep $oidc_id) ]]
    then
        echo "You already have an IAM OIDC provider associated with your cluster."
    else
        echo "No IAM OIDC identity provider found. Creating one for your cluster."
        eksctl utils associate-iam-oidc-provider --cluster $CLUSTER --approve
    fi

    eksctl create iamserviceaccount \
        --name aws-otel-sa \
        --namespace aws-otel-eks \
        --cluster $CLUSTER \
        --role-name "$CLUSTER-aws-otel-sa" \
        --attach-policy-arn $POLICY \
        --approve
fi

if [ ! -z "$LOG_RETENTION_DAYS" ]
then
    log_group_name="/aws/containerinsights/$CLUSTER/performance"
    log_group_created=$(aws logs describe-log-groups --log-group-name-prefix $log_group_name $region_arg $profile_arg --query 'length(logGroups[])' --output text)
    if [[ $log_group_created  -eq 0 ]]
    then
        echo "Create log group $log_group_name"
        aws logs create-log-group --log-group-name $log_group_name $region_arg $profile_arg
    fi

    echo "Set log group $log_group_name retention to $LOG_RETENTION_DAYS days"
    aws logs put-retention-policy --log-group-name $log_group_name --retention-in-days $LOG_RETENTION_DAYS $region_arg $profile_arg
fi

ami_ids=($(aws ec2 describe-instances --filters "Name=tag-key,Values=kubernetes.io/cluster/$CLUSTER" $region_arg $profile_arg --query 'Reservations[*].Instances[*].ImageId' --output text | sort -u))
for launch_template_id in ${launch_template_ids[@]}; do
    ami_ids+=($(aws ec2 describe-launch-template-versions $region_arg $profile_arg --launch-template-id ${launch_template_id} --versions $Default $Latest --query "LaunchTemplateVersions[*].LaunchTemplateData.ImageId" --output text | sed 's/\s/\n/g' | sort -u))
done

ami_names=($(aws ec2 describe-images $region_arg $profile_arg --image-ids ${ami_ids[@]} --query 'Images[*].Name' --output text))
echo "Detected AMIs: ${ami_names[@]}"

pattern="^bottlerocket-aws-k8s-1\.2[0-9]"
bottlerocket_amis_count=0
other_amis_count=0
for ami_name in ${ami_names[@]}; do
    if [[ $ami_name =~ $pattern ]]; then
        ((bottlerocket_amis_count++))
    else
        ((other_amis_count++))
    fi
done

echo "Update kubeconfig"
aws eks update-kubeconfig --name $CLUSTER $region_arg $profile_arg

if [[ $bottlerocket_amis_count -gt 0 && $other_amis_count -eq 0 ]]; then
    echo "Bottlerocket AMI detected, installing Amazon OTEL Agent with dockershim.sock patch."
    echo "Bottlerocket overrides containerd's socket to be dockershim.sock: https://github.com/bottlerocket-os/bottlerocket/issues/1126#issuecomment-698045504"
    echo "Issue description: https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/ContainerInsights-troubleshooting.html#ContainerInsights-troubleshooting-bottlerocket"
    curl -o otel-container-insights-infra.yaml https://uniskai-eu-templates.s3.amazonaws.com/eks/otel-container-insights-infra.yaml
    sed -i 's/path: \/run\/containerd\/containerd.sock/path: \/run\/dockershim.sock/g' otel-container-insights-infra.yaml

    echo "Applying Amazon OTEL Agent manifest with /run/dockershim.sock patch"
    kubectl apply -f otel-container-insights-infra.yaml

elif [[ $bottlerocket_amis_count -gt 0 && $other_amis_count -gt 0 ]]; then
    echo "Mix of BottleRocket and other AMI types detected."
    echo "If you ever face an issue where billing data appears, but grouping by workload properties (Service, Controller, etc.) does not work,"
    echo "and the cluster view is empty; please try to install Amazon OTEL Agent with dockershim.sock patch"
    echo "Details: https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/ContainerInsights-troubleshooting.html#ContainerInsights-troubleshooting-bottlerocket"
    echo "Installing Amazon OTEL Agent"
    curl https://uniskai-eu-templates.s3.amazonaws.com/eks/otel-container-insights-infra.yaml | kubectl apply -f -

else
    echo "Installing Amazon OTEL Agent"
    curl https://uniskai-eu-templates.s3.amazonaws.com/eks/otel-container-insights-infra.yaml | kubectl apply -f -
fi