Skip to content

EKS S3 cross account authorization issue - oidc provider

0

Our S3 account exist in AWS account 344230057588 and OIDC enabled EKS in 456476723052. We have configured iam policy for S3 access and enabled trust policy for EKS oidc provider. We were able to annotate the EKS pod's service account with this iam role but the pod at run time which has Java code is not able to assume the custom role created by us but instead picking up the default node arn. We would like some direction on troubleshooting this issue and to force the java application to pick our custom role

sample logs, when we print identity.arn() where u can see node arn getting invoked.

1 Answer
0

Hello.

Is it possible that OIDC is not available because the Java version is too old?
https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts-minimum-sdk.html

I think this is probably resolved in the latest version, but why not try explicitly setting "credentialsProvider" as discussed in the GitHub issue below?
https://github.com/aws/aws-sdk-java-v2/issues/1470

EXPERT

answered 9 months ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.