Add a section to the EKS documentation that explains how to create a cross-account IRS

Steps: Create an idp in account B the matches the issuer URL o

Cross account roles for IRSA about amazon-eks-user-guide HOT 3 CLOSED

awsdocs commented on June 17, 2024 2

Cross account roles for IRSA

from amazon-eks-user-guide.

Comments (3)

jicowan commented on June 17, 2024

Steps:

Create an idp in account B the matches the issuer URL of the idp in account A.
Create a role in account B that has the trust policy bound to the idp in account B and the service account name from the cluster, e.g. system:serviceaccount:namespace:svc-account.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Federated": "arn:aws:iam::ACCOUNT_B:oidc-provider/oidc.eks.us-west-2.amazonaws.com/id/9F6ED3261A48DE38989C858A2AABBCC "
      },
      "Action": "sts:AssumeRoleWithWebIdentity",
        "StringEquals": {
          "oidc.eks.us-west-2.amazonaws.com/id/9F6ED3261A48DE38989C858A2AABBCC:sub": "system:serviceaccount:xl:myserviceaccount",
          "oidc.eks.us-west-2.amazonaws.com/id/9F6ED3261A48DE38989C858A2AABBCC:aud": "sts.amazonaws.com"
        }
      }
    }
  ]
}

from amazon-eks-user-guide.

JanisOrlovs commented on June 17, 2024

Hello,
Thank you for info, this part is documented at all. However, for me worked without describing "aud"

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Federated": "arn:aws:iam::ACCOUNT_B:oidc-provider/oidc.eks.us-west-2.amazonaws.com/id/9F6ED3261A48DE38989C858A2AABBCC "
      },
      "Action": "sts:AssumeRoleWithWebIdentity",
        "StringEquals": {
          "oidc.eks.us-west-2.amazonaws.com/id/9F6ED3261A48DE38989C858A2AABBCC:sub": "system:serviceaccount:xl:myserviceaccount",
        }
      }
    }
  ]
}

from amazon-eks-user-guide.

jimdial-aws commented on June 17, 2024

Sorry for the delayed response to this. I think what you've described is covered in Cross-Account IAM Permissions. If you disagree, just let me know. Thanks.

from amazon-eks-user-guide.

Recommend Projects