search

jtblin / kube2iam

kube2iam provides different AWS IAM roles for pods running on Kubernetes
BSD 3-Clause "New" or "Revised" License
1.97k stars 318 forks source link

Cross account access with kube2iam #278

Open vignesh-v-nutanix opened 3 years ago

vignesh-v-nutanix commented 3 years ago

I have dev and stage aws accounts which are separately configured with kube2iam. I want to have one of the pods in stage account to create records in dev route 53. What i have did so far?

image

PS: The above ensure that from console I am able to do a switch role to access the dev account from stage

The below is the IAM role that one of my pods uses and it already has few permissions and this role arn is used as a pod annotation to allow the pod to communicate with other aws resources - this is working fine. I have additionally added one policy i created from the first image which is marked in the arrow. image image

For some reason, the pods in stage doesnt have permission to contact the dev route 53..

any help would be appreciated. thanks