<p>I'm working on a project where I need to list AWS S3 buckets in Java Spring Boot. Initially, I used secret and access keys  passed through application.properties its working for me and the code looked like this:</p>
<pre><code>@GetMapping(&quot;service2/getListOfS3Buckets&quot;)
public String getListOfS3Buckets() {
    AmazonS3 s3Client = AmazonS3ClientBuilder
            .standard()
            .withRegion(awsRegion)
            .withCredentials(new AWSStaticCredentialsProvider(new BasicAWSCredentials(awsAccessKey, awsSecretKey)))
            .build();

    List&lt;Bucket&gt; buckets = s3Client.listBuckets();

    StringBuilder response = new StringBuilder(&quot;List of S3 Buckets:\n&quot;);
    for (Bucket bucket : buckets) {
        response.append(bucket.getName()).append(&quot;\n&quot;);
    }

    return response.toString();
}

</code></pre>
<p>However, I understand that this is not considered best practice, and I'd like to improve it by using an IAM role attached to a service account. I've attached the IAM role to the pod, but when I use the following code, I encounter an internal error:</p>
<ol>
<li><p>I created an IAM policy named &quot;my-policy&quot; with the necessary S3 permissions.</p>
</li>
<li><p>I attached this policy to an IAM role named &quot;my-role&quot; using the following AWS CLI commands:</p>
</li>
</ol>
<pre><code>cat &gt;my-policy.json &lt;&lt;EOF
{
    &quot;Version&quot;: &quot;2012-10-17&quot;,
    &quot;Statement&quot;: [
        {
            &quot;Effect&quot;: &quot;Allow&quot;,
            &quot;Action&quot;: [
                &quot;s3:Get*&quot;,
                &quot;s3:List*&quot;,
                &quot;s3:Describe*&quot;,
                &quot;s3-object-lambda:Get*&quot;,
                &quot;s3-object-lambda:List*&quot;
            ],
            &quot;Resource&quot;: &quot;*&quot;
        }
    ]
}
EOF
  
</code></pre>
<pre><code>
aws iam create-policy --policy-name my-policy --policy-document file://my-policy.json


eksctl create iamserviceaccount --name my-service-account --namespace kube-system --cluster my-cluster --role-name my-role \
    --attach-policy-arn arn:aws:iam::111122223333:policy/my-policy --approve

kubectl describe serviceaccount my-service-account -n kube-system


Name:                my-service-account
Namespace:           kube-system
Labels:              app.kubernetes.io/managed-by=eksctl
Annotations:         eks.amazonaws.com/role-arn: arn:aws:iam::11111222222:role/my-role
Image pull secrets:  &lt;none&gt;
Mountable secrets:   &lt;none&gt;
Tokens:              &lt;none&gt;
Events:              &lt;none&gt;


</code></pre>
<p>And this is my code</p>
<pre><code>@GetMapping(&quot;service2/getListOfS3Buckets&quot;)
public String getListOfS3Buckets() {
    AmazonS3 s3Client = AmazonS3ClientBuilder
            .standard()
            .withRegion(awsRegion) // Specify your desired AWS region here
            .withCredentials(DefaultAWSCredentialsProviderChain.getInstance())
            .build();

    List&lt;Bucket&gt; buckets = s3Client.listBuckets();

    StringBuilder response = new StringBuilder(&quot;List of S3 Buckets:\n&quot;);
    for (Bucket bucket : buckets) {
        response.append(bucket.getName()).append(&quot;\n&quot;);
    }

    return response.toString();
}

</code></pre>
<p>I receive an internal error with the following message:</p>
<pre><code>Request processing failed: com.amazonaws.SdkClientException: Unable to load AWS credentials from any provider in the chain: [EnvironmentVariableCredentialsProvider: Unable to load AWS credentials from environment variables (AWS_ACCESS_KEY_ID (or AWS_ACCESS_KEY) and AWS_SECRET_KEY (or AWS_SECRET_ACCESS_KEY)), SystemPropertiesCredentialsProvider: Unable to load AWS credentials from Java system properties (aws.accessKeyId and aws.secretKey), WebIdentityTokenCredentialsProvider: To use assume role profiles the aws-java-sdk-sts module must be on the class path., com.amazonaws.auth.profile.ProfileCredentialsProvider@59639381: profile file cannot be null, com.amazonaws.auth.EC2ContainerCredentialsProviderWrapper@39201cc7: Failed to connect to service endpoint:]

</code></pre>
<p>I need assistance in resolving this issue and successfully using the IAM role attached to the service account for AWS authentication. Any guidance or suggestions would be greatly appreciated.</p>

Nasil Kp
<p>Error says that you haven't annotated the service account with proper IAM role.</p>
<p>Steps to resolve this issue:</p>
<ol>
<li>Create an IAM Role and attach the s3 access policy.</li>
<li>Annotate the service account with the above created IAM role.</li>
</ol>
<p>Please follow the steps(1,2,3) in this document
<a href="https://repost.aws/knowledge-center/eks-restrict-s3-bucket" rel="nofollow noreferrer">https://repost.aws/knowledge-center/eks-restrict-s3-bucket</a></p>
