search

awslabs / mountpoint-s3-csi-driver

Built on Mountpoint for Amazon S3, the Mountpoint CSI driver presents an Amazon S3 bucket as a storage volume accessible by containers in your Kubernetes cluster.
Apache License 2.0
214 stars 26 forks source link

Cross-account bucket access using chained AssumeRole #283

Open mcwm6 opened 3 weeks ago

mcwm6 commented 3 weeks ago

Is the driver currently capable for supporting cross-account bucket access using chained AssumeRole?

Ref: https://docs.aws.amazon.com/eks/latest/userguide/cross-account-access.html (Example Use chained AssumeRole operations)

I have a bucket in Account B, and pods in Account A will use a service account to first assume a (web identity) role with its own cluster's OIDC provider and then further assumes a role from Account B to access the bucket.

/triage support

muddyfish commented 3 weeks ago

The CSI Driver currently doesn't support using chained AssumeRole. However, we do support two other approaches described here: https://github.com/awslabs/mountpoint-s3-csi-driver/blob/main/docs/CONFIGURATION.md#cross-account-bucket-access (using cross account bucket policies, and using IRSA set up from a different account).

I'll leave this open as a feature request

geocomm-shenningsgard commented 3 weeks ago

@muddyfish does the CSI Driver support accessing an S3 bucket in another account via a VPC interface/gateway endpoint? I know this is possible via the mountpoint-s3 library itself, but didn't see any documentation on setting it up via the CSI Driver.

muddyfish commented 3 weeks ago

It should do - please check the Mountpoint documentation for details.

Please create a separate issue if you have problems with it, as VPC/gateway support is off topic for the OP's question.