Managing AWS Credentials in EKS Pods with EKS Pod Identities

At AWS re 2023, the EKS team introduced Pod Identity to simplify how Kubernetes workloads receive IAM credentials.

Applications in a pod can use the AWS SDK or AWS CLI to call AWS services with IAM permissions. EKS Pod Identity provides a simpler alternative to distributing credentials: you associate an IAM role with a Kubernetes service account, then configure pods to use that service account.

This guide configures an application running in Amazon EKS to access Amazon S3 through EKS Pod Identity.

Step 0: Before you start

1. AWS account.
2. EKSctl used for communicating with the cluster API server.
3. AWS-IAM-Authenticator – with necessary permissions to call the EKS API.
4. EKS Cluster (v1.27) - If you don’t know how to set up an EKS cluster, click here.

Step 1: Install the EKS Pod Identity Agent Add-on and Create an IAM Role

Our first step is to set up a new IAM role with required permissions to access my S3 bucket.

1
{
2
    "Version": "2012-10-17",
3
    "Statement": [
4
        {
5
            "Effect": "Allow",
6
            "Principal": {
7
                "Service": "pods.eks.amazonaws.com"
8
            },
9
            "Action": [
10
                "sts:AssumeRole",
11
                "sts:TagSession"
12
            ]
13
        }
14
    ]
15
}

Then you need to install the EKS Pod Identity Agent add-on. You can do it via the console or eksctl. I will choose eksctl because it’s easier and quicker. Don’t forget to replace the name of the cluster and the region that you chose.

eksctl create addon --cluster EKS-pod-identity --name eks-pod-identity-agent --region us-east-1

Now, navigate to the ‘Access’ tab in the EKS cluster, click on ‘Pod Identity Associations’ to map our IAM role to Kubernetes pods.

Step 2: Create an S3 bucket and a service account to test the new Pod Identity

Create an S3 bucket for testing, again, you can do it via the console or AWS CLI

aws s3api create-bucket --bucket fadyio-eks-pod-identity --region us-east-1

Then, create a service account with the IAM role that we previously created

1
apiVersion: v1
2
kind: ServiceAccount
3
metadata:
4
  annotations:
5
    eks.amazonaws.com/role-arn: arn:aws:iam::<YOUR-ACCOUNTID>:role/EKS-Pod-Identity
6
  name: pod-identity-sa
7
  namespace: default

Step 3: Create a Pod to test access to the S3 bucket

1
apiVersion: v1
2
kind: Pod
3
metadata:
4
  name: ubuntu-identity
5
spec:
6
  serviceAccountName: pod-identity-sa
7
  containers:
8
  - command:
9
    - sleep
10
    - "3600"
11
    image: ubuntu
12
    name: ubuntu-identity

kubectl apply -f FILENAME.yaml

we will go into the pod to install the AWS CLI and try to list S3 buckets

kubectl exec -it ubuntu-identity -- /bin/bash

from the AWS CLI Installation Guide

apt update && apt install unzip curl -y
curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip"
unzip awscliv2.zip
./aws/install

Let’s try to copy the AWS CLI zip file to the S3 bucket

aws s3 cp awscliv2.zip s3://fadyio-eks-pod-identity/

Summing it up

EKS Pod Identity is a game-changer that simplifies IAM permissions for applications that runs on EKS, A hassle-free configuration experience that makes it easy to define the necessary IAM permissions for your applications in Amazon EKS, Plus, it brings a bunch of security perks like Least Privilege, Credential Isolation, Auditability, Reusability, and better Scalability into the mix.