<p>I want to deploy an application in AWS EKS using kubernetes. My application needs to access the SQS and AWS S3. I am not sure how to allow the kubernetes application to access the SQS and S3. I looked into RBAC but I guess RBAC only provides access to manage the cluster, namespace or pods.</p>

<p>I am trying to pass the access key and secret key as the secrets to the environment variable and allow the permission. But I think this is not a good idea.</p>

<p>Is there any other way like creating the IAM role and passing the role to the pods running the application?
If I try to provide the permission in the worker node role then all the pods sharing the node will get that permission. I need something like the specific pod or container will get the permission</p>

<p>I also tried to create the RBAC in which a role is assigned to the group and the group is bind to the namespace.</p>

<pre><code>apiVersion: v1
kind: ConfigMap
metadata:
  name: aws-auth
  namespace: default
data:
  mapRoles: |
    - rolearn: arn:aws:iam::xxxxxxxxx:role/EksWorkers-NodeInstanceRole-xxxxx
      username: system:node:{{EC2PrivateDNSName}}
      groups:
        - system:bootstrappers
        - system:nodes
    - rolearn: arn:aws:iam::xxxxxxxxx:role/iam-role-for-application
      groups:
        - app-group
</code></pre>

<p>and</p>

<pre><code>kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: admins
  namespace: default
subjects:
- kind: Group
  name: app-group
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: ClusterRole
  name: admin
  apiGroup: rbac.authorization.k8s.io
</code></pre>

<p><code>aws-auth</code> configMap is used to map users/roles to the cluster.</p>

<p>Update: Here is how you can do it natively </p>

<p><a href="https://aws.amazon.com/blogs/opensource/introducing-fine-grained-iam-roles-service-accounts/" rel="nofollow noreferrer">https://aws.amazon.com/blogs/opensource/introducing-fine-grained-iam-roles-service-accounts/</a>
<a href="https://docs.aws.amazon.com/en_pv/eks/latest/userguide/iam-roles-for-service-accounts.html" rel="nofollow noreferrer">https://docs.aws.amazon.com/en_pv/eks/latest/userguide/iam-roles-for-service-accounts.html</a></p>

<p><s>
For giving an IAM role to pods you can use one of the below tools</p>

<p><a href="https://github.com/jtblin/kube2iam" rel="nofollow noreferrer">https://github.com/jtblin/kube2iam</a></p>

<p><a href="https://github.com/uswitch/kiam" rel="nofollow noreferrer">https://github.com/uswitch/kiam</a></p>

<p>Amazon team is working on to bring this natively</p>

<p><a href="https://github.com/aws/containers-roadmap/projects/1?card_filter_query=iam" rel="nofollow noreferrer">https://github.com/aws/containers-roadmap/projects/1?card_filter_query=iam</a>
<a href="https://github.com/aws/containers-roadmap/issues/23" rel="nofollow noreferrer">https://github.com/aws/containers-roadmap/issues/23</a> </s></p>
