By using AWS re:Post, you agree to the Terms of Use
/Access to Secrets Manager from pod in EKS/

Access to Secrets Manager from pod in EKS

0

Hi,

I'm trying to access to secrets in Secrets Manager from a pod deployed in EKS cluster. This cluster was created with eksctl command.

  • I attached a iam policy with grants to iam role attached to EC2 nodes:
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "secretsmanager:GetResourcePolicy",
                "secretsmanager:GetSecretValue",
                "secretsmanager:DescribeSecret",
                "secretsmanager:ListSecretVersionIds"
            ],
            "Resource": "arn:aws:secretsmanager:eu-west-1:[masked]:*"
        },
        {
            "Effect": "Allow",
            "Action": "secretsmanager:ListSecrets",
            "Resource": "*"
        }
    ]
}
  • This iam role was created by eksctl command, and I see that it has this trust relationship:
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Service": "ec2.amazonaws.com"
            },
            "Action": "sts:AssumeRole"
        }
    ]
}

When I try from awscli, to retrieve a secret from a running pod in EKS cluster, I have this error:

# aws secretsmanager get-secret-value --secret-id arn:aws:secretsmanager:eu-west-1:[masked]

An error occurred (AccessDenied) when calling the AssumeRole operation: User: arn:aws:sts::[masked] is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::[masked]

awscli has configured in config file:

[default]
region = eu-west-1
output = json
role_arn = arn:aws:iam::[masked]
credential_source = Ec2InstanceMetadata

What's wrong?

Kind regards

2 Answers
0

Thank you very much Chris, these aproach are fine for me.

answered 3 months ago
  • My pleasure, J Garcia! Can you please mark the question as "Answered" so other users can benefit from our exchange?

0

I think the issue is you're trying to have your pods access the nodes IAM role. Unless the AWS resource access requirements are uniform throughout your pods, you may be better off leveraging the service account you apply at a pod level.

In order to fix this; you should try to have the IAM role being assumed be the IAM role for service accounts. This documentation should help: https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html

Alternatively, you may want to look at the secrets manager integration for EKS: https://docs.aws.amazon.com/secretsmanager/latest/userguide/integrating_csi_driver.html

answered 3 months ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions