How to grant a pod running in a Kubernetes cluster necessary permissions to access cloud resources such as S3 buckets? The most straight forward approach is to save some API key in the pod and use it to authenticate against cloud APIs. If the cluster is running inside the cloud, an IAM role can then be bound to a service account in the cluster, which is both convenient and safe.

I’ll compare the ways IAM role and service account bind in AWS/EKS and GCP/GKE.

AWS/EKS

The EKS is the managed Kubernetes service in AWS. To bind an EKS service account to an AWS IAM role:

1. Create an IAM OIDC provider for your cluster
2. Create an IAM role which can be assumed by the EKS service account
3. Annotate the EKS service account to assume the IAM role

GCP/GKE

The GKE is the managed Kubernetes service in GCP. In GCP this is called Workload Identity(WLI), in a nut shell it binds a GKE service account to a GCP IAM service account, so it’s a bit different than the one above. The full instruction is here but in short:

1. Enable WLI for the GKE cluster
2. Create or update node-pool to enable WLI
3. Create IAM service account and assign roles with necessary permissions
4. Allow IAM service account to be impersonated by a GKE service account
5. Annotate the GKE service account to impersonate the GCP service account

🙂