<p>During development process - I'm running k8s cluster on my dev machine inside Minikube, running several services.</p>

<p>The services should access AWS resources, like S3 bucket. For that - the pods should somehow get AWS credentials.</p>

<p>What are the options to authenticate the pods with AWS user?
should I pass aws_access_key_id and aws_secret_access_key in the docker env?</p>

<p>How would it work on production (inside k8s on EKS)? does the node's role passed into the pods?  </p>

<p>A good way to authenticate locally is to create a Kubernetes <code>Secret</code> containing the AWS credentials. You can then reference the secret in the environment variables of the deployment of your service, e.g.:</p>

<pre><code>name: AWS_ACCESS_KEY
valueFrom:
  secretKeyRef:
    name: my-aws-secret
    key: access-key    

</code></pre>

<p>In EKS, all pods can access the role from the Node. This is of course not ideal for a production situation as most likely you want a more restricted set of permissions for a specific pod. You can check out <a href="https://github.com/jtblin/kube2iam" rel="nofollow noreferrer">kube2iam</a> as a project you can use to restrict the AWS capabilities of a single pod.</p>
