<p>I set up an EKS cluster which entirely uses pods on Fargate. I want to run something as a non-root user in a container which needs access to S3. For this, I created a <code>ServiceAccount</code> and added an IAM role with the appropriate S3 policies.</p>
<p>I started a bare-bones pod which just waits indefinitely and used <code>kubectl exec</code> to drop to a bash in the container as root. There I installed the AWS CLI and tried some s3 operations on the command line, which works fine, so the pod can talk to S3 and get data.</p>
<p>Now, my real workload runs as non-root, and has to access stuff on S3, but when it tries to access it, it fails because the token's permissions are set to 600 and belong to root. The non-root user in the container also can't <code>sudo</code> and this is intended. This means I get &quot;permission denied&quot;.</p>
<p>Is it possible to give a non-root user access to the serviceaccount token in a Fargate pod or do I have to allow my user to <code>sudo</code> and <code>chmod</code> the token to 644 in the startup script?</p>

<p>The fact that the token is mounted via permissions 600 is actually <a href="https://github.com/kubernetes-sigs/external-dns/pull/1185" rel="noreferrer">a known issue</a>. A workaround is to specify an <code>fsGroup</code>.</p>
<p>Something like this works for me:</p>
<pre class="lang-yaml prettyprint-override"><code>---
apiVersion: v1
kind: Pod
metadata:
  name: foo
  labels:
    name: foo
spec:
  containers:
    - name: foo
      image: foo:bar
      resources:
        limits:
          memory: &quot;128Mi&quot;
          cpu: &quot;500m&quot;
      command:
        - &quot;/do-something.sh&quot;
  securityContext:
    fsGroup: 65534
  serviceAccountName: serviceAccountWithAccessToS3
</code></pre>
