NOTE: similar question asked here, but no proper solution provided.
I setted up an EKS cluster via eksctl tool with single EC2 node. Deploy a Pod inside the EC2 node, this Pod writes the logs into s3 bucket. All worked fine when I used IAM user with key and secret. But now I want this Pod to use IAM Role instead. This Pod uses a newly created role with AmazonS3FullAccess
permissions named prod-airflow-logs
. According to the Docs, I also added "ec2.amazonaws.com"
in this role's trust Relationship as follows;
{"Version": "2012-10-17","Statement": [ {"Effect": "Allow","Principal": {"Service": ["s3.amazonaws.com","ec2.amazonaws.com" ] },"Action": "sts:AssumeRole" } ]}
EC2 Node has its own Role named eksctl-prod-eks-nod-NodeInstanceRole-D4JQ2Q6D9GDA
. If I understand correct, this role has to assume role prod-airflow-logs
in order to allow container Pod to access and store logs in s3. According to the same Docs, I attached an in-line policy in this Node Role as follows;
{"Version": "2012-10-17","Statement": [ {"Sid": "VisualEditor0","Effect": "Allow","Action": ["iam:GetRole","iam:PassRole","ec2:*","iam:ListInstanceProfiles","iam:GetRolePolicy" ],"Resource": "*" } ]}
But I still get following error in kubernetes pod when it tried to store logs on s3;
botocore.exceptions.ClientError: An error occurred (AccessDenied) when calling the AssumeRole operation: User: arn:aws:sts::XXXXXXX:assumed-role/eksctl-prod-eks-nod-NodeInstanceRole-D4JQ2Q6D9GDA/i-0254e5b5b36e58f79 is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::XXXXXX:role/prod-airflow-logs
The only thing I don't understand from this error is, which user is it referring to ?Where on earth is this user User: arn:aws:sts::XXXXXXX:assumed-role/eksctl-prod-eks-nod-NodeInstanceRole-D4JQ2Q6D9GDA/i-0254e5b5b36e58f79
? Would appreciate if someone could point out what exactly I am missing here.