1

I have an EKS deployment with a service account with policy and role that enable access to S3.

This works well for root account in the container. The container can execute aws s3 cp ... with no issue.

The problem is that another user cannot. It gets AccessDenied from the S3 service, meaning it does not have the correct credentials.

So my question is: how to give rights to another user in the container (which is linux based) in this case?

(I don't think it's specific to Eks as service accounts are generic to kubernetes.)

unludo
  • 4,912
  • 7
  • 47
  • 71

1 Answers1

1

You can check out the reference for how IAM roles for service accounts work in k8s here.
In short, in order to allow another user to use the IAM role the same environment variables have to be configured for that user, and it needs to be able to access the path specified in the AWS_WEB_IDENTITY_TOKEN_FILE variable.
Once both of these prerequisites are met, the user should be able to use the same identity as the root user.

Yaron Idan
  • 6,207
  • 5
  • 44
  • 66
  • I exported both AWS_WEB_IDENTITY_TOKEN_FILE and AWS_ROLE_ARN for the user and it works. Thanks! – unludo Jun 09 '22 at 09:34
  • Which means I have to pass these variables to the container... – unludo Jun 09 '22 at 09:34
  • Happy to hear it worked. The env vars should be populated automatically. I think the reason you're not seeing them is because you are using more than one user for the container you are running - which should be avoided unless there is a really good reason to do so. – Yaron Idan Jun 09 '22 at 15:02