Similar to assigning an IAM role to a ec2 instance to grant access to the applications running on it to access AWS services, you can assign an IAM role to each individual k8s service.

This will allow you to get finer control and only grant the access to aws resources that the pod really needs.

Add IdentityProvider

Create OpenID Connect provider. If you create using the console, it will calculate the CA thumbprint for you.

Provider Url

Copy from the OpenID Connect Provider URL (without the protocol).

example:

oidc.eks.us-east-2.amazonaws.com/id/ABD123ABD123ABD123ABD123

Audience

sts.amazonaws.com

Create IAM account(s)

Crate one IAM account per service.

Create a file with the policy document for the service (e.g. my-service-policy.json):

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Federated": "arn:aws:iam::1234512345:oidc-provider/oidc.eks.us-east-2.amazonaws.com/id/ABD123ABD123ABD123ABD123"
            },
            "Action": "sts:AssumeRoleWithWebIdentity",
            "Condition": {
                "StringEquals": {
                    "oidc.eks.us-east-2.amazonaws.com/id/ABD123ABD123ABD123ABD123:sub": "system:serviceaccount:my_namespace:my_service"
                }
            }
        }
    ]
}

Create the IAM role using the aws cli:

aws iam create-role \
    --region us-east-2 \
    --role-name my-service-in-namespace \
    --assume-role-policy-document file://my-service-policy.json

Assign any policies to this new IAM role that you want your service pods to be able to assume.

The arn for your the IAM role is going to look like:

arn:aws:iam::1234512345:role/my-service-in-namespace

where 1234512345 is your AWS account id.

Create K8s Service account

Create a service account for your service.

kubectl create sa my_service -n my_namespace

Link accounts

Annotate the k8s service account with the corresponding IAM role:

kubectl annotate sa my_service -n my_namespace eks.amazonaws.com/role-arn=arn:aws:iam::1234512345:role/my-service-in-namespace

Add service account to k8 service

apiVersion: apps/v1
kind: Deployment
# ...
spec:
  # ...
  template:
    spec:
      # ...
      serviceAccount: my-service

References

Categories: TL;DR

0 Comments

Leave a Reply

Your email address will not be published. Required fields are marked *