January 28, 2025 7 min to read

AWS IRSA (IAM Roles for Service Accounts)

A comprehensive guide to AWS IRSA implementation and workflow

Overview

Today, we’ll explore AWS IRSA (IAM Roles for Service Accounts) and understand how it enables secure AWS service access for pods running in EKS clusters.

What is AWS IRSA?

AWS IAM Roles for Service Accounts (IRSA) is a method of granting access to AWS services using ServiceAccount on a pad running on a Kubernetes cluster managed by AWS EKS (Elastic Kubernetes Service).

So how can I allocate an IAM Role when ServiceAccount is not a resource for AWS?

OpenID Connect, called OIDC, and the Security Token Service, called STS, perform the function.

What is OIDC(OpenID Connect)?

OpenID Connect (OIDC) is an authentication protocol built on OAuth 2.0 that allows users to authenticate with a third-party service using their existing accounts.

It extends OAuth 2.0 authorization to provide user information in addition to tokens.

Create and Verify EKS OIDC Provider

What is ServiceAccount?

ServiceAccount is a Kubernetes resource that represents a service account, which is an identity for an application or a user.

It is used to manage access to resources within a Kubernetes cluster.

Create IAM Role and ServiceAccount

What is STS(Security Token Service)?

STS is a service that provides temporary security credentials for AWS resources.

It is used to manage access to AWS resources securely.

🔄 IRSA Workflow

• This is an example of an application operating on Pod getting AWS S3 bucket list.
• Of course, it is assumed that you have the authority to access other resources inside the EKS (EKS → EKS).
• This authority is usually set to Kubernetes RBAC (Role-Based Access Control).

Key Components Explained

OIDC (OpenID Connect)

• Authentication protocol built on OAuth 2.0
• Enables identity verification through JSON Web Tokens
• Facilitates secure token exchange between EKS and AWS

AWS STS (Security Token Service)

• Provides temporary security credentials
• Manages short-term access to AWS resources
• Integrates with IAM roles for secure access

JWT (JSON Web Token)

• Secure method for transmitting information
• Digitally signed for verification
• Uses HMAC algorithm or RSA/ECDSA public/private key pairs

Implementation Steps

1. Create an OIDC Provider for your EKS Cluster

# Get your EKS cluster OIDC issuer URL
OIDC_PROVIDER=$(aws eks describe-cluster --name my-cluster --query "cluster.identity.oidc.issuer" --output text | sed -e "s/^https:\/\///")

# Create the OIDC Identity Provider in IAM
aws iam create-open-id-connect-provider \
  --url https://$OIDC_PROVIDER \
  --client-id-list sts.amazonaws.com \
  --thumbprint-list <thumbprint>

2. Create an IAM Role with Trust Policy

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Federated": "arn:aws:iam::<ACCOUNT_ID>:oidc-provider/<OIDC_PROVIDER>"
      },
      "Action": "sts:AssumeRoleWithWebIdentity",
      "Condition": {
        "StringEquals": {
          "<OIDC_PROVIDER>:sub": "system:serviceaccount:default:my-service-account",
          "<OIDC_PROVIDER>:aud": "sts.amazonaws.com"
        }
      }
    }
  ]
}

3. Create a Kubernetes ServiceAccount

apiVersion: v1
kind: ServiceAccount
metadata:
  name: my-service-account
  namespace: default
  annotations:
    eks.amazonaws.com/role-arn: arn:aws:iam::<ACCOUNT_ID>:role/my-iam-role

4. Reference the ServiceAccount in Your Pod

apiVersion: apps/v1
kind: Deployment
metadata:
  name: my-app
spec:
  replicas: 1
  selector:
    matchLabels:
      app: my-app
  template:
    metadata:
      labels:
        app: my-app
    spec:
      serviceAccountName: my-service-account
      containers:
      - name: aws-cli
        image: amazon/aws-cli
        command: ['sh', '-c', 'aws s3 ls && sleep 3600']

Common Use Cases

Example: Application Reading from SQS Queue

apiVersion: apps/v1
kind: Deployment
metadata:
  name: sqs-consumer
spec:
  replicas: 2
  selector:
    matchLabels:
      app: sqs-consumer
  template:
    metadata:
      labels:
        app: sqs-consumer
    spec:
      serviceAccountName: sqs-consumer-sa
      containers:
      - name: app
        image: my-sqs-consumer:latest
        env:
        - name: AWS_REGION
          value: us-west-2
        - name: SQS_QUEUE_URL
          value: https://sqs.us-west-2.amazonaws.com/123456789012/my-queue

Best Practices

Troubleshooting IRSA

Debugging Commands

# Check if service account has the correct annotation
kubectl describe serviceaccount my-service-account

# Test AWS API access from a pod
kubectl run aws-cli --image=amazon/aws-cli --command -- sleep infinity
kubectl exec -it aws-cli -- aws sts get-caller-identity

# Check for recent authentication events
aws cloudtrail lookup-events --lookup-attributes AttributeKey=EventName,AttributeValue=AssumeRoleWithWebIdentity

References

• AWS IRSA Documentation
• Diving into IAM Roles for Service Accounts
• AWS STS Documentation