Configuring a Kubernetes service account to assume an IAM role

From wikieduonline
Revision as of 11:43, 24 October 2023 by Welcome (talk | contribs)
Jump to navigation Jump to search



cat >trust-relationship.json <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Federated": "arn:aws:iam::$account_id:oidc-provider/$oidc_provider"
      },
      "Action": "sts:AssumeRoleWithWebIdentity",
      "Condition": {
        "StringEquals": {
          "$oidc_provider:aud": "sts.amazonaws.com",
          "$oidc_provider:sub": "system:serviceaccount:$namespace:$service_account"
        }
      }
    }
  ]
}
EOF
aws iam create-role --role-name my-role --assume-role-policy-document file://trust-relationship.json --description "my-role-description"


kubectl describe serviceaccount
Creating an IAM OIDC provider for your EKS cluster

See also

Advertising: