Quantcast
Channel: Active questions tagged amazon-ec2 - Stack Overflow
Viewing all articles
Browse latest Browse all 29250

Cannot access s3 from application running on EKS EC2 instance, IAM assume role permissions issue

$
0
0

NOTE: similar question asked here, but no proper solution provided.

I setted up an EKS cluster via eksctl tool with single EC2 node. Deploy a Pod inside the EC2 node, this Pod writes the logs into s3 bucket. All worked fine when I used IAM user with key and secret. But now I want this Pod to use IAM Role instead. This Pod uses a newly created role with AmazonS3FullAccess permissions named prod-airflow-logs. According to the Docs, I also added "ec2.amazonaws.com" in this role's trust Relationship as follows;

{"Version": "2012-10-17","Statement": [    {"Effect": "Allow","Principal": {"Service": ["s3.amazonaws.com","ec2.amazonaws.com"        ]      },"Action": "sts:AssumeRole"    }  ]}

EC2 Node has its own Role named eksctl-prod-eks-nod-NodeInstanceRole-D4JQ2Q6D9GDA. If I understand correct, this role has to assume role prod-airflow-logs in order to allow container Pod to access and store logs in s3. According to the same Docs, I attached an in-line policy in this Node Role as follows;

{"Version": "2012-10-17","Statement": [        {"Sid": "VisualEditor0","Effect": "Allow","Action": ["iam:GetRole","iam:PassRole","ec2:*","iam:ListInstanceProfiles","iam:GetRolePolicy"            ],"Resource": "*"        }    ]}

But I still get following error in kubernetes pod when it tried to store logs on s3;

botocore.exceptions.ClientError: An error occurred (AccessDenied) when calling the AssumeRole operation: User: arn:aws:sts::XXXXXXX:assumed-role/eksctl-prod-eks-nod-NodeInstanceRole-D4JQ2Q6D9GDA/i-0254e5b5b36e58f79 is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::XXXXXX:role/prod-airflow-logs

The only thing I don't understand from this error is, which user is it referring to ?Where on earth is this user User: arn:aws:sts::XXXXXXX:assumed-role/eksctl-prod-eks-nod-NodeInstanceRole-D4JQ2Q6D9GDA/i-0254e5b5b36e58f79 ? Would appreciate if someone could point out what exactly I am missing here.


Viewing all articles
Browse latest Browse all 29250

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>