Access to Secrets Manager from pod in EKS

Question

Hi,

I'm trying to access to secrets in Secrets Manager from a pod deployed in EKS cluster. This cluster was created with *eksctl*  command.

* I attached a iam policy with grants to iam role attached to EC2 nodes:
```
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "secretsmanager:GetResourcePolicy",
                "secretsmanager:GetSecretValue",
                "secretsmanager:DescribeSecret",
                "secretsmanager:ListSecretVersionIds"
            ],
            "Resource": "arn:aws:secretsmanager:eu-west-1:[masked]:*"
        },
        {
            "Effect": "Allow",
            "Action": "secretsmanager:ListSecrets",
            "Resource": "*"
        }
    ]
}
```

* This iam role was created by *eksctl* command, and I see that it has this trust relationship:
```
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Service": "ec2.amazonaws.com"
            },
            "Action": "sts:AssumeRole"
        }
    ]
}
```

When I try from awscli, to retrieve a secret from a running pod in EKS cluster, I have this error:
```
# aws secretsmanager get-secret-value --secret-id arn:aws:secretsmanager:eu-west-1:[masked]

An error occurred (AccessDenied) when calling the AssumeRole operation: User: arn:aws:sts::[masked] is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::[masked]
```

awscli has configured in config file:
```
[default]
region = eu-west-1
output = json
role_arn = arn:aws:iam::[masked]
credential_source = Ec2InstanceMetadata
```

What's wrong?

Kind regards

Answer

I think the issue is you're trying to have your pods access the nodes IAM role. Unless the AWS resource access requirements are uniform throughout your pods, you may be better off leveraging the service account you apply at a pod level.

In order to fix this; you should try to have the IAM role being assumed be the IAM role for service accounts.  This documentation should help: https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html

Alternatively, you may want to look at the secrets manager integration for EKS: https://docs.aws.amazon.com/secretsmanager/latest/userguide/integrating_csi_driver.html

Answer

Thank you very much Chris, these aproach are fine for me.

Access to Secrets Manager from pod in EKS

Contenido relevante