Consider using Kubernetes Service Accounts to authenticate with AWS

[upodroid]

You can leverage OIDC to login to AWS instead of access keys.

You'll need to do the following:

• Create an ID Provider with the following command:

  aws iam create-open-id-connect-provider \
  --url https://container.googleapis.com/v1/projects/PROJECT_ID/locations/LOCATION/clusters/CLUSTER_NAME \
  --client-id-list sts.amazonaws.com \
  --thumbprint-list 08745487e891c19e3078c1f2a07e452950ef36f6

• Create a role that looks like this:

  REDACTED  MCW0CDP3YY  ~  Desktop  Git  $  aws iam get-role --role-name gke-to-aws
  {
  "Role": {
      "Path": "/",
      "RoleName": "gke-to-aws",
      "RoleId": "AROA3CFW0000000000",
      "Arn": "arn:aws:iam::0000000000:role/gke-to-aws",
      "CreateDate": "2022-06-06T15:55:56+00:00",
      "AssumeRolePolicyDocument": {
          "Version": "2012-10-17",
          "Statement": [
              {
                  "Effect": "Allow",
                  "Principal": {
                      "Federated": "arn:aws:iam::000000000:oidc-provider/container.googleapis.com/v1/projects/REDACTED/locations/europe-west2/clusters/dev"
                  },
                  "Action": "sts:AssumeRoleWithWebIdentity",
                  "Condition": {
                      "StringEquals": {
                          "container.googleapis.com/v1/projects/REDACTED/locations/europe-west2/clusters/dev:sub": "system:serviceaccount:default:prod"
                      }
                  }
              }
          ]
      },
      "Description": "",
      "MaxSessionDuration": 3600,
      "RoleLastUsed": {
          "LastUsedDate": "2022-06-06T16:24:10+00:00",
          "Region": "us-east-1"
      }
  }
  }

• Deploy a pod like this:

  apiVersion: v1
  kind: Pod
  metadata:
  name: aws-cli-example
  namespace: default
  spec:
  serviceAccount: prod
  containers:
  - name: aws-cli
  image: amazon/aws-cli:latest
  command:
  - /bin/bash
  - -c
  - "set -eu -o pipefail; while true; do echo potato; sleep 500; done"
  env:
  - name: AWS_ROLE_ARN
    value: arn:aws:iam::00000000:role/gke-to-aws
  - name: AWS_WEB_IDENTITY_TOKEN_FILE
    value: /var/run/secrets/aws-iam-token/serviceaccount/token
  - name: AWS_REGION
    value: us-east-1
  volumeMounts:
  - mountPath: /var/run/secrets/aws-iam-token/serviceaccount
    name: aws-iam-token
    readOnly: true
  volumes:
  - name: aws-iam-token
  projected:
    defaultMode: 420
    sources:
    - serviceAccountToken:
        audience: sts.amazonaws.com
        expirationSeconds: 86400
        path: token

https://cloud.google.com/anthos/clusters/docs/multi-cloud/aws/how-to/use-workload-identity-aws This particular feature isn't restricted to Anthos Clusters.

/area infra

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue or PR as fresh with /remove-lifecycle stale
• Mark this issue or PR as rotten with /lifecycle rotten
• Close this issue or PR with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[riaankleinhans]

/remove-lifecycle stale Work in progress in Add S3 sync jobs #27344