Cross account roles for IRSA

[jicowan]

Add a section to the EKS documentation that explains how to create a cross-account IRSA role, e.g. pod in cluster A in account A assumes a role in account B.

[jicowan]

Steps:

1. Create an idp in account B the matches the issuer URL of the idp in account A.
2. Create a role in account B that has the trust policy bound to the idp in account B and the service account name from the cluster, e.g. system:serviceaccount:namespace:svc-account.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Federated": "arn:aws:iam::ACCOUNT_B:oidc-provider/oidc.eks.us-west-2.amazonaws.com/id/9F6ED3261A48DE38989C858A2AABBCC "
      },
      "Action": "sts:AssumeRoleWithWebIdentity",
        "StringEquals": {
          "oidc.eks.us-west-2.amazonaws.com/id/9F6ED3261A48DE38989C858A2AABBCC:sub": "system:serviceaccount:xl:myserviceaccount",
          "oidc.eks.us-west-2.amazonaws.com/id/9F6ED3261A48DE38989C858A2AABBCC:aud": "sts.amazonaws.com"
        }
      }
    }
  ]
}

[JanisOrlovs]

Hello,
Thank you for info, this part is documented at all. However, for me worked without describing "aud"

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Federated": "arn:aws:iam::ACCOUNT_B:oidc-provider/oidc.eks.us-west-2.amazonaws.com/id/9F6ED3261A48DE38989C858A2AABBCC "
      },
      "Action": "sts:AssumeRoleWithWebIdentity",
        "StringEquals": {
          "oidc.eks.us-west-2.amazonaws.com/id/9F6ED3261A48DE38989C858A2AABBCC:sub": "system:serviceaccount:xl:myserviceaccount",
        }
      }
    }
  ]
}

[jimdial-aws]

Sorry for the delayed response to this. I think what you've described is covered in Cross-Account IAM Permissions. If you disagree, just let me know. Thanks.