<p>I setup a EKS cluster and integrated AWS Secrets Manager in it following the steps mentioned in <a href="https://github.com/aws/secrets-store-csi-driver-provider-aws" rel="nofollow noreferrer">https://github.com/aws/secrets-store-csi-driver-provider-aws</a> and it worked as expected.</p>
<p>Now we have a requirement to integrate the AWS Secrets Manager on an on-premises k8s cluster and I am unable to follow the same steps as they seem to be explicitly for AWS EKS based clusters.
I googled around a bit and found you can call the Secrets Manager programmatically using one of the ways in <a href="https://docs.aws.amazon.com/secretsmanager/latest/userguide/asm_access.html" rel="nofollow noreferrer">https://docs.aws.amazon.com/secretsmanager/latest/userguide/asm_access.html</a>, but this approach wont work for us.</p>
<p>Is there a k8s way to directly connect to AWS secrets Manager without setting up AWS-CLI and the OIDC cluster ID on the on-premises cluster?
Any help would be highly appreciated.</p>

sethu2912
<p>You can setup <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_create_oidc.html" rel="nofollow noreferrer">external OIDC providers with AWS</a> and also <a href="https://faun.pub/configuring-kubernetes-cluster-to-use-openid-connect-authentication-787e1b293f76?gi=ae4751451eff" rel="nofollow noreferrer">setup K8s to with OIDC</a>, but that is a lot of work.</p>
<p>AWS recently announced <a href="https://aws.amazon.com/about-aws/whats-new/2022/07/aws-identity-access-management-iam-roles-anywhere-workloads-outside-aws/" rel="nofollow noreferrer">IAM Roles Anywhere</a> which will let you use host based certificates to authenticate, but you will still have to call the Secrets Manager APIs.</p>
<p>If you are willing to retrieve secrets through etcd (which may store the secrets base64 encoded on the cluster) you can look at using the opensource <a href="https://external-secrets.io" rel="nofollow noreferrer">External Secrets</a> solution.</p>
