AWS IAM Role for Service Account

Setup up IAM Role for Service Account to get fine-grained access control to AWS services

Fine grain control AWS access at pod level

With IAM Roles for Service Account on Amazon EKS clusters, you can associate an IAM role with a Kubernetes service account. This service account can then provide AWS permissions to the containers in any pod that uses that service account. With this feature, you no longer need to provide extended permissions to the worker node IAM role so that pods on that node can call AWS APIs.

OIDC federation access allows you to assume IAM roles via the Secure Token Service (STS), enabling authentication with an OIDC provider, receiving a JSON Web Token (JWT), which in turn can be used to assume an IAM role. Kubernetes, on the other hand, can issue so-called projected service account tokens, which happen to be valid OIDC JWTs for pods. Our setup equips each pod with a cryptographically-signed token that can be verified by STS against the OIDC provider of your choice to establish the pod’s identity. Additionally, we’ve updated AWS SDKs with a new credential provider that calls sts:AssumeRoleWithWebIdentity, exchanging the Kubernetes-issued OIDC token for AWS role credentials.

Enable IAM role for service account

Note: This feature requires you use an EKS cluster. For self-managed AWS Kubernetes cluster, To start benefiting from IRSA, follow the instructions in the Amazon EKS Pod Identity Webhook Github repo to set up the webhook.

In order to use IAM roles for service account feature, please set enablePodIamPolicy to true in aws plugin in manifest https://raw.githubusercontent.com/kubeflow/manifests/v1.1-branch/kfdef/kfctl_aws.v1.1.0.yaml or https://raw.githubusercontent.com/kubeflow/manifests/v1.1-branch/kfdef/kfctl_aws_cognito.v1.1.0.yaml

  1. plugins:
  2.   - kind: KfAwsPlugin
  3.     metadata:
  4.       name: aws
  5.     spec:
  6.       region: us-west-2
  7.       enablePodIamPolicy: true

kfctl will setup OIDC Identity Provider for your EKS cluster and create two IAM roles, kf-admin-${AWS_REGION}-${AWS_CLUSTER_NAME} and kf-user-${AWS_REGION}-${AWS_CLUSTER_NAME}.

  • kf-admin-${AWS_REGION}-${AWS_CLUSTER_NAME} - kfctl attach alb, optional fsx, cloud-watch required policies to the role and role will be used by kubeflow control plane components like alb-ingress-controller, pipeline, fluend-cloud-watch and fsx for lustre CSI driver, etc.

  • kf-user-${AWS_REGION}-${AWS_CLUSTER_NAME} - This is designed to be used by end user. Cluster admin can use this role in profile and every user’s service account default-editor will have this role attached. By default, no policies is attached to this role, user can attach policies by their own.

Here is an example of profile:

  1. apiVersion: kubeflow.org/v1beta1
  2. kind: Profile
  3. spec:
  4.   plugins:
  5.   - kind: AwsIamForServiceAccount
  6.     spec:
  7.       awsIamRole: arn:aws:iam::${AWS_ACCOUNT_ID}:role/${AWS_IAM_ROLE}

Profile controller will add annotation eks.amazonaws.com/role-arn: arn:aws:iam::${AWS_ACCOUNT_ID}:role/kf-user-${AWS_REGION}-${AWS_CLUSTER_NAME} to user’s default-editor service account.

  1. apiVersion: v1
  2. kind: ServiceAccount
  3. metadata:
  4.   name: default-editor
  5.   namespace: userA
  6.   annotations:
  7.     eks.amazonaws.com/role-arn: arn:aws:iam::${AWS_ACCOUNT_ID}:role/${AWS_IAM_ROLE}

At the same time, profile controller add "oidc.eks.us-west-2.amazonaws.com/id/${OIDC_WEB_IDENTITY_PROVIDER}:sub": "system:serviceaccount:${user_namespace}:default-editor" to trust relationship of IAM role ${AWS_CLUSTER_NAME}.

This is trust relationships of role ${AWS_IAM_ROLE}

  1. {
  2.   "Version": "2012-10-17",
  3.   "Statement": [
  4.     {
  5.       "Effect": "Allow",
  6.       "Principal": {
  7.         "Federated": "arn:aws:iam::348134392524:oidc-provider/oidc.eks.us-west-2.amazonaws.com/id/${OIDC_WEB_IDENTITY_PROVIDER}"
  8.       },
  9.       "Action": "sts:AssumeRoleWithWebIdentity",
  10.       "Condition": {
  11.         "StringEquals": {
  12.           "oidc.eks.us-west-2.amazonaws.com/id/${OIDC_WEB_IDENTITY_PROVIDER}:aud": "sts.amazonaws.com",
  13.           "oidc.eks.us-west-2.amazonaws.com/id/${OIDC_WEB_IDENTITY_PROVIDER}:sub": [
  14.             "system:serviceaccount:userA:default-editor",
  15.             "system:serviceaccount:userB:default-editor",
  16.           ]
  17.         }
  18.       }
  19.     }
  20.   ]
  21. }

Last modified 04.08.2020: Remove outdate banner for AWS docs (#2080) (efc5b0cf)