Access to Secrets Manager from pod in EKS

Question

Hi,

I'm trying to access to secrets in Secrets Manager from a pod deployed in EKS cluster. This cluster was created with *eksctl*  command.

* I attached a iam policy with grants to iam role attached to EC2 nodes:
```
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "secretsmanager:GetResourcePolicy",
                "secretsmanager:GetSecretValue",
                "secretsmanager:DescribeSecret",
                "secretsmanager:ListSecretVersionIds"
            ],
            "Resource": "arn:aws:secretsmanager:eu-west-1:[masked]:*"
        },
        {
            "Effect": "Allow",
            "Action": "secretsmanager:ListSecrets",
            "Resource": "*"
        }
    ]
}
```

* This iam role was created by *eksctl* command, and I see that it has this trust relationship:
```
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Service": "ec2.amazonaws.com"
            },
            "Action": "sts:AssumeRole"
        }
    ]
}
```

When I try from awscli, to retrieve a secret from a running pod in EKS cluster, I have this error:
```
# aws secretsmanager get-secret-value --secret-id arn:aws:secretsmanager:eu-west-1:[masked]

An error occurred (AccessDenied) when calling the AssumeRole operation: User: arn:aws:sts::[masked] is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::[masked]
```

awscli has configured in config file:
```
[default]
region = eu-west-1
output = json
role_arn = arn:aws:iam::[masked]
credential_source = Ec2InstanceMetadata
```

What's wrong?

Kind regards

Answer

Thank you very much Chris, these aproach are fine for me.

Answer

I think the issue is you're trying to have your pods access the nodes IAM role. Unless the AWS resource access requirements are uniform throughout your pods, you may be better off leveraging the service account you apply at a pod level.

In order to fix this; you should try to have the IAM role being assumed be the IAM role for service accounts.  This documentation should help: https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html

Alternatively, you may want to look at the secrets manager integration for EKS: https://docs.aws.amazon.com/secretsmanager/latest/userguide/integrating_csi_driver.html

Access to Secrets Manager from pod in EKS

Relevant questions

AWS Batch on Fargate: AccessDenied trying to access secrets manager

How do I retrieve my secrets from secret manager in a pipeline build?

Cannot access Secrets Manager from Lightsail

Secrets Manager Error Message

AWS Secrets Manager with boto3 in python

Secrets Manager rotation intermittent timeout

Do we need Lambda extensions for accessing AWS Secrets Manager ?

Access to Secrets Manager from pod in EKS

Access secrets from secrets manager into the code the running EC2 docker

Access Control in Secrets Manager for Federated Users