<p>I'm currently exploring running an Istio / Kubernetes cluster on AWS using EKS. I would like to be able to assign a different IAM role to each service running in the cluster to limit the AWS privileges of each service.</p>
<p>In non-Istio Kubernetes clusters this facility is provided by projects such as <a href="https://github.com/jtblin/kube2iam" rel="nofollow noreferrer">kube2iam</a> but this doesn't seem ideal in the Istio world as <code>kube2iam</code> relies on <code>iptables</code> rules and Istio is already using <code>iptables</code> rules to divert all outbound traffic to the Envoy sidecar.</p>
<p>The Istio <a href="https://istio.io/docs/concepts/security/" rel="nofollow noreferrer">security documentation</a> says that identity model caters for different underlying implementations and on AWS that implementation is IAM:</p>
<blockquote>
<p>In the Istio identity model, Istio uses the first-class service identity to determine the identity of a service. This gives great flexibility and granularity to represent a human user, an individual service, or a group of services. On platforms that do not have such identity available, Istio can use other identities that can group service instances, such as service names.</p>
<p>Istio service identities on different platforms:</p>
<p>Kubernetes: Kubernetes service account<br />
GKE/GCE: may use GCP service account<br />
GCP: GCP service account<br />
AWS: AWS IAM user/role account</p>
</blockquote>
<p>But I haven't come across any additional documentation about how to assign IAM roles to Istio <a href="https://istio.io/docs/concepts/security/#servicerole" rel="nofollow noreferrer">ServiceRoles</a>.</p>
<p>Has anyone found a solution to this?</p>
<p>UPDATE: See <a href="https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html" rel="nofollow noreferrer">IRSA</a></p>

<p>Istio configuration allows to exclude some IP ranges from the proxy
<a href="https://istio.io/docs/tasks/traffic-management/egress/egress-control/#direct-access-to-external-services" rel="nofollow noreferrer">https://istio.io/docs/tasks/traffic-management/egress/egress-control/#direct-access-to-external-services</a></p>

<p>So you if you add <code>global.proxy.excludeIPRanges: "169.254.169.254/32"</code> to the istio configuration, all requests to AWS metadata IP will not be handled by istio but directly sent to this IP.</p>

<p>It will allow the kube2iam iptables rule to be applied.</p>

<p>cf. <a href="https://github.com/istio/istio/issues/9297#issuecomment-516353921" rel="nofollow noreferrer">https://github.com/istio/istio/issues/9297#issuecomment-516353921</a></p>
