Skip to main content

🔐 EKS IRSA (IAM Roles for Service Accounts) – S3 Read‑Only Access Guide

This guide shows how to securely allow a Kubernetes pod running on Amazon EKS to read data from an S3 bucket using IAM Roles for Service Accounts (IRSA) — without hard‑coding AWS credentials. 🚀

🪜 Step 1: Get Your OIDC Provider for EKS​

First, find the OIDC issuer URL for your EKS cluster:

aws eks describe-cluster \
  --name <your-cluster-name> \
  --query "cluster.identity.oidc.issuer" \
  --output text

📤 Output example:

https://oidc.eks.me-south-1.amazonaws.com/id/ABCDEF1234567890

🔍 Verify OIDC Provider Exists in IAM​

aws iam list-open-id-connect-providers | grep ABCDEF1234567890

✅ If you see output → OIDC is already configured

❌ If you don’t see it → create it using eksctl

eksctl utils associate-iam-oidc-provider \
  --cluster <your-cluster-name> \
  --approve

🪜 Step 2: Create an IAM Policy for S3 Access​

Create a policy file named s3-access-policy.json:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["s3:ListBucket"],
      "Resource": "arn:aws:s3:::aiops-loadtest-reports"
    },
    {
      "Effect": "Allow",
      "Action": ["s3:GetObject"],
      "Resource": "arn:aws:s3:::aiops-loadtest-reports/*"
    }
  ]
}

🛡️ Scope:

  • Read‑only access
  • Only for one bucket

➕ Create the IAM Policy​

aws iam create-policy \
  --policy-name AIOpsLoadTestS3Access \
  --policy-document file://s3-access-policy.json

📌 Save the Policy ARN from the output — you’ll need it next.

🪜 Step 3: Create an IAM Role for the Kubernetes Service Account​

The easiest and safest way is using eksctl:

eksctl create iamserviceaccount \
  --name loadtest-viewer-sa \
  --namespace default \
  --cluster <your-cluster-name> \
  --attach-policy-arn arn:aws:iam::<your-account-id>:policy/AIOpsLoadTestS3Access \
  --approve \
  --override-existing-serviceaccounts

✅ What This Does​

  • 🧾 Creates a Kubernetes ServiceAccount: loadtest-viewer-sa
  • 🔐 Creates an IAM Role with trust to EKS OIDC
  • 🔗 Attaches the S3 read‑only policy
  • 🪝 Automatically annotates the ServiceAccount

🪜 Step 4: Reference the Service Account in Deployment YAML​

Update your Deployment manifest to use the ServiceAccount:

apiVersion: apps/v1
kind: Deployment
metadata:
  name: loadtest-viewer
spec:
  replicas: 1
  selector:
    matchLabels:
      app: loadtest-viewer
  template:
    metadata:
      labels:
        app: loadtest-viewer
    spec:
      serviceAccountName: loadtest-viewer-sa   # 👈 IRSA enabled here
      containers:
        - name: loadtest-viewer
          image: <your-ecr-repo-url>:latest
          ports:
            - containerPort: 8080
          env:
            - name: AWS_REGION
              value: "me-south-1"
            - name: S3_BUCKET
              value: "aiops-loadtest-reports"

🚫 No access keys required

🪜 Step 5: Deploy the Application​

kubectl apply -f deployment.yaml

Verify:

kubectl get pods

🪜 Step 6: Verify the IAM Role Inside the Pod​

Exec into the running pod:

kubectl exec -it <pod-name> -- bash

Check if AWS credentials are injected automatically:

curl 169.254.170.2$AWS_CONTAINER_CREDENTIALS_RELATIVE_URI

📤 You should see temporary credentials (AccessKeyId, Token, Expiration).

🧪 Step 7: Test S3 Access from Inside the Pod​

If AWS CLI is installed:

aws s3 ls s3://aiops-loadtest-reports

Or using SDK in your app:

  • ✅ List objects
  • ✅ Download reports
  • ❌ Upload or delete (blocked by policy)

🧠 Common Troubleshooting​

❌ AccessDenied

  • Check ServiceAccount name
  • Verify IAM policy attachment
  • Ensure pod is restarted after SA creation

❌ No credentials found

  • OIDC provider missing
  • Wrong cluster name

🏁 Final Summary​

ComponentPurpose
🔐 IRSASecure AWS access without secrets
🪝 OIDC ProviderTrust between EKS & IAM
🧾 IAM PolicyFine‑grained S3 permissions
🧑‍💻 ServiceAccountIdentity for pods
📦 PodUses AWS permissions safely

✅ This setup is production‑grade, secure, and AWS‑recommended.