<p>I'm currently exploring running an Istio / Kubernetes cluster on AWS using EKS. I would like to be able to assign a different IAM role to each service running in the cluster to limit the AWS privileges of each service.</p>
<p>In non-Istio Kubernetes clusters this facility is provided by projects such as <a href="https://github.com/jtblin/kube2iam" rel="nofollow noreferrer">kube2iam</a> but this doesn't seem ideal in the Istio world as <code>kube2iam</code> relies on <code>iptables</code> rules and Istio is already using <code>iptables</code> rules to divert all outbound traffic to the Envoy sidecar.</p>
<p>The Istio <a href="https://istio.io/docs/concepts/security/" rel="nofollow noreferrer">security documentation</a> says that identity model caters for different underlying implementations and on AWS that implementation is IAM:</p>
<blockquote>
<p>In the Istio identity model, Istio uses the first-class service identity to determine the identity of a service. This gives great flexibility and granularity to represent a human user, an individual service, or a group of services. On platforms that do not have such identity available, Istio can use other identities that can group service instances, such as service names.</p>
<p>Istio service identities on different platforms:</p>
<p>Kubernetes: Kubernetes service account<br />
GKE/GCE: may use GCP service account<br />
GCP: GCP service account<br />
AWS: AWS IAM user/role account</p>
</blockquote>
<p>But I haven't come across any additional documentation about how to assign IAM roles to Istio <a href="https://istio.io/docs/concepts/security/#servicerole" rel="nofollow noreferrer">ServiceRoles</a>.</p>
<p>Has anyone found a solution to this?</p>
<p>UPDATE: See <a href="https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html" rel="nofollow noreferrer">IRSA</a></p>

<p>I'm also struggling with this and have found little help. I did have success with this persons suggestion
<a href="https://groups.google.com/forum/m/#!topic/istio-users/3-fp2JPb2dQ" rel="nofollow noreferrer">https://groups.google.com/forum/m/#!topic/istio-users/3-fp2JPb2dQ</a></p>

<p>I was having no luck getting kube2iam working until I added that serviceentry (see below or follow link)</p>

<p>Basically you add this</p>

<pre><code>apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
  name: apipa
spec:
  hosts:
  - 169.254.169.254
  ports:
  - number: 80
    name: http
    protocol: HTTP
  resolution: DNS
  location: MESH_EXTERNAL
</code></pre>

<p>From looking at the istio-proxy sidecar before applying the serviceentry you could lots of 404 errors in the log with paths all looking like aws api calls. After the service entry those turned to 200's. </p>

<p>UPDATE....
Later I found out that this is expected requirement when using istio for any external-mesh communication. See <a href="https://istio.io/docs/concepts/traffic-management/#service-entries" rel="nofollow noreferrer">https://istio.io/docs/concepts/traffic-management/#service-entries</a> </p>
