<p>Follow this <a href="https://aws.amazon.com/blogs/opensource/introducing-fine-grained-iam-roles-service-accounts/" rel="nofollow noreferrer">link</a>, I can create a pod whose service account's role can access the AWS resources; so the pod can access them either.</p>
<p>Then, inspired by this <a href="https://www.eksworkshop.com/intermediate/210_jenkins/deploy/" rel="nofollow noreferrer">EKS-Jenkins-Workshop</a>, I change this workshop a little bit. I want to deploy Jenkins Pipeline, this Jenkins Pipeline can create a pod whose account service's role can access aws resources, but the problem is the cdk code in this pod cannot access AWS resources. (I write the cdk code to access AWS resources, reference (Your first AWS CDK app)[https://docs.aws.amazon.com/cdk/latest/guide/hello_world.html])</p>
<p>This is my Jenkinsfile</p>
<pre><code>pipeline {
  agent {
    kubernetes {
      yaml &quot;&quot;&quot;
apiVersion: v1
kind: Pod
metadata:
  name: jenkins-agent
  Namespace: default
spec:
  serviceAccountName: jenkins
  containers:
  - name: node-yuvein
    image: node
    command:
    - cat
    tty: true
&quot;&quot;&quot;
    }
  }

  stages {
    stage('Build') {
      steps {
        container('node-yuvein') {
          dir('hello-cdk'){
            sh &quot;pwd&quot;
            sh 'npm --version'
            sh 'node -v'
            sh 'npm install -g typescript'
            sh 'npm install -g aws-cdk'
            sh 'npm install @aws-cdk/aws-s3'
            sh 'npm run build'
            sh 'cdk deploy'
          }
        }
      }
    } 
  }
}
</code></pre>
<p>When I run the pipeline, it has this error:</p>
<pre><code>User: arn:aws:sts::450261875116:assumed-role/eksctl-eksworkshop-eksctl3-nodegr-NodeInstanceRole-1TCVDYSM1QKSO/i-0a4df3778517df0c6 is not authorized to perform: cloudformation:DescribeStacks on resource: arn:aws:cloudformation:us-west-2:450261875116:stack/HelloCdkStack/*
</code></pre>
<p>I am a beginner of K8s, Jenkins and cdk.
Hope someone can help me.
Thanks a lot.</p>
<p>Further Debugging:</p>
<ol>
<li>In Jenkins Console, I can get <code>serviceAccountName: &quot;jenkins&quot;</code>, and the name of my service account in EKS is <code>jenkins</code>.</li>
<li>the pod also get correct ENV:</li>
</ol>
<pre><code>+ echo $AWS_ROLE_ARN
arn:aws:iam::450261875116:role/eksctl-eksworkshop-eksctl3-addon-iamservicea-Role1-YYYFXFS0J4M2

+ echo $AWS_WEB_IDENTITY_TOKEN_FILE
/var/run/secrets/eks.amazonaws.com/serviceaccount/token
</code></pre>
<ol start="3">
<li>The node.js and npm I installed are the lastest version.</li>
</ol>
<pre><code>+ npm --version
6.14.8

+ node -v
v14.13.0
</code></pre>
<ol start="4">
<li></li>
</ol>
<pre><code>+ aws sts get-caller-identity
{
    &quot;UserId&quot;: &quot;AROAWRVNS7GWO5C7QJGRF:botocore-session-1601436882&quot;,
    &quot;Account&quot;: &quot;450261875116&quot;,
    &quot;Arn&quot;: &quot;arn:aws:sts::450261875116:assumed-role/eksctl-eksworkshop-eksctl3-addon-iamservicea-Role1-YYYFXFS0J4M2/botocore-session-1601436882&quot;
}
</code></pre>
<p>when I run this command, it appears my service account role. But I still get the original error.</p>

<p>Jenkins <code>podTemplate</code> has <code>serviceAccount</code> option:
<a href="https://github.com/jenkinsci/kubernetes-plugin#pod-and-container-template-configuration" rel="nofollow noreferrer">https://github.com/jenkinsci/kubernetes-plugin#pod-and-container-template-configuration</a></p>
<ul>
<li>Create an IAM role mapped to an EKS cluster</li>
<li>Create a ServiceAccount mapped to an IAM role</li>
<li>Pass ServiceAccount name to a podTemplate</li>
</ul>
<p>Further debugging:</p>
<ol>
<li>Ensure the pod has correct service account name.</li>
<li>Check if pod got <code>AWS_ROLE_ARN</code> and <code>AWS_WEB_IDENTITY_TOKEN_FILE</code> env vars (they are added automatically).</li>
<li>Check if AWS SDK you use is above the minimal version: <a href="https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts-minimum-sdk.html" rel="nofollow noreferrer">https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts-minimum-sdk.html</a></li>
<li>Run <code>aws sts get-caller-identity</code> to see the role, don't waste time on running an actual job.</li>
</ol>
