How EKS Pod Identity provides a more secure and optimized AWS services -Applications connectivity.
Tags: kubernetes, podsecurity, eks, iam
Published: 2024-01-31 22:43:50

Every AWS Re-Invent new releases are awaited with high expectation. One of my highlights of the reinvent 2023 was the simplified application access to AWS service with EKS pod Identity. My  Kubernetes journey started sometime in 2021 and I have grown to love it, not only because it is greatly leveraged at my job, but also because of its extremely improving power as a micro-service. If all of this is new to you, check-out the link below on getting starting with Kubernetes on AWS.[^1]

**What is Amazon EKS Pod Identity?**

Amazon EKS Pod Identity is a feature within Amazon Elastic Kubernetes Service (EKS) that simplifies the process of managing AWS Identity and Access Management (IAM) permissions for Kubernetes applications running on Amazon EKS clusters. It allows you to assign specific IAM roles to individual Kubernetes pods, ensuring granular and secure access to AWS resources and APIs.

**How was this managed prior to EKS Pod Identity?**

Before the introduction of EKS Pod Identity, the primary way to manage IAM permissions for Kubernetes pods was through solutions such as:

___Kube2iam___

An open-source solution that assigns IAM roles to Kubernetes pods running in an Amazon EKS cluster. It creates a secure and controlled way of managing pod-level IAM access. The mechanism behind kube2iam is to intercept AWS metadata API requests from pods, check their attributes, and provide the appropriate IAM credentials based on a pod's annotation or Kubernetes namespace.
While kube2iam has been helpful in securing pod-level access to AWS resources, it has certain challenges:

- _Additional component to manage:_ As kube2iam operates as a separate component, it increases overall management overhead.

- _Complex configuration:_ Setting up and configuring kube2iam can be complex, requiring multiple steps and in-depth knowledge about AWS networking and IAM.

- _Limited support for new features and improvements:_ kube2iam is a community-supported project, potentially making it slower to introduce new features or bug fixes compared to AWS managed services.

___kiam___

Another open-source solution that provides a secure way to manage pod-level AWS IAM roles in Kubernetes clusters. It intercepts AWS metadata API calls from the pods and responds with the appropriate IAM credentials based on annotations. Kiam has a more robust security model than kube2iam, achieved by separating the roles of a metadata agent and a server, with strict communication policies enforced using TLS and gRPC.

___AWS Security Token Service (STS)___

 Using the AWS STS, you can create short-lived credentials to manage access to AWS resources from within Kubernetes. This method works by assuming an IAM role in a pod and using the aws sts assume-role command to obtain temporary credentials. While STS is a useful mechanism for providing temporary access to AWS resources, it can be cumbersome to maintain and less flexible when compared to kube2iam or kiam.

___AWS IAM Roles for Service Accounts (IRSA)___

Amazon introduced AWS IAM Roles for Service Accounts (IRSA) as an official AWS solution that streamlines pod-level IAM access within EKS clusters. IRSA allows you to associate an IAM role directly with a Kubernetes service account, so that applications running within a pod can use the role without sharing any credentials in the process. This automation simplifies and enhances security in managing pod-level AWS access.
While there are several alternatives available for managing IAM permissions in Kubernetes, EKS Pod Identity seeks to provide a robust and easy-to-use native solution for Amazon EKS users.

**What makes Amazon EKS Pod Identity a more powerful tool?** 

Amazon EKS Pod Identity offers several advantages for managing IAM permissions in EKS clusters:
1. ___Simplified permissions___: With EKS Pod Identity, you can assign specific IAM roles at the pod level. This granular control allows each pod to have the required permissions to access only the necessary AWS resources, simplifying the permissions management process and ensuring a more organized cluster.
2. ___Enhanced security___: By following the principle of least privilege, EKS Pod Identity enables enhanced security measures for the applications running in the EKS cluster. It limits each pod's access to only the permitted resources, reducing the potential surface area for exploitation.
3. ___Native integration___: EKS Pod Identity is designed to work natively with Amazon EKS and AWS SDKs. This seamless integration ensures a more efficient developer experience while managing IAM access for their applications in the cluster.
4. ___Ease of management___: Compared to third-party solutions like kube2iam or kiam, EKS Pod Identity provides a more streamlined, native approach to IAM management. It eliminates the need for additional components and simplifies the overall management process, making it easier for administrators to maintain a secure and organized EKS environment.
5. ___Automatic credential provisioning___: EKS Pod Identity automates the process of providing temporary security credentials to pods when they make AWS API requests. This automation not only keeps the environment secure but also minimizes the complexity involved in credential management and IAM role assumption.

**Hands-On Demo**

Let's experience the power of **_EKS Pod Identity_**.

Requirements:
**_An AWS Service (s3 bucket):_** We shall create an s3 bucket, upload an image and later on access it.
**_An Application:_** As we know applications are housed in Containers and containers resides in pods. These pods are managed by Kubernetes, so we need an EKS Cluster.
**_IAM Permission:_** For Identity and Access management. 


![AWS S3-bucket](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/643kjhmt86aiyqtkmvj6.png)

An S3 bucket named myeksbucket-01 was created and an image uploaded into it.

I created an IAM Role called eksClusterRole and attached a permission policy so as to get access to the created s3 bucket.


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/wduqwua84ifur3zp4mky.png)

Next to the permission, we need a Trust Relationship with a principal labelled pod.eks.amazonaws.com.


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/d7dnbdr1funpun2aj030.png)

Next we need the pod identity agent, which will reside in the EKS Cluster. We need to create a cluster. The default setting will suffice. For the add-ons stage, It is important to chose amazon EKS Pod Identity agent as an extra add-on


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/qjxiwefpgfwemf2gw5uq.png)



![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/kh39l01msmkzww8r8ghd.png)

We need create a pod identity association. The Kubernetes namespace and service account can be created on the fly, if you don't already have in your cluster. Just enter the desired names in the field.


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/byym5el66hmtbdnid6fa.png)

The Cluster creating process might take up to 15 minutes.

After the successful creation the cluster, we need to access it through the AWS-CLI on the same browser with the following command:


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/8nzhf0zboxyceg97b6w5.png)

Next we access the service as shown below:



![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/mkv642mz9toqj3rd3t4n.png)

The following commands can be used to map the IAM role to the Kubernetes pod:

_$ aws eks create-pod-identity-association \
  --cluster-name <CLUSTER_NAME> \
  --namespace <NAMESPACE> \
  --service-account <SERVICE_ACCOUNT_NAME> \
  --role-arn <IAM_ROLE_ARN>_

The following command can be used to install the EKS Pod Identity Agent into the cluster:

_aws eks create-addon \
--cluster-name <CLUSTER_NAME> \
--addon-name eks-pod-identity-agent \
--addon-version <Addon-version>_

These are further steps on achieving the required results.  [^2]

I hope these blog was helpful. I look forward to feedback and collaborations.

[^1]: [Getting started with Kubernetes on AWS](https://aws.amazon.com/eks/getting-started/)
[^2]: [Amazon EKS Pod Identity simplifies tutorials](https://aws.amazon.com/blogs/aws/amazon-eks-pod-identity-simplifies-iam-permissions-for-applications-on-amazon-eks-clusters/)