<p>Followed this link: <a href="https://aws.amazon.com/blogs/containers/enabling-cross-account-access-to-amazon-eks-cluster-resources/" rel="nofollow noreferrer">Enabling cross-account access to Amazon EKS cluster resources</a>
I can make a pod in an Amazon EKS cluster hosted in <code>ci account</code> interact and manage the AWS resources in a <code>target account</code>.
This is the aws config file:</p>
<pre><code>[profile ci-env]
role_arn = arn:aws-cn:iam::CICD_ACCOUNT:role/eksctl-jenkins-cicd-demo-addon-iamserviceacc-Role1-1AQZO394370HE
web_identity_token_file = /var/run/secrets/eks.amazonaws.com/serviceaccount/token
region = cn-north-1

[profile target-env]
role_arn = arn:aws-cn:iam::TARGET_ACCOUNT:role/target-account-iam-role
source_profile = ci-env
role_session_name = xactarget
region = cn-north-1
</code></pre>
<p>When I run <code>aws s3 ls --profile target-env</code>, it worked and listed the s3 buckets in my <code>target account</code>.</p>
<p>Then, I want to deploy a <a href="https://docs.aws.amazon.com/cdk/latest/guide/hello_world.html" rel="nofollow noreferrer">cdk app</a> on <code>ci account</code> which can create s3 bucket on <code>target account</code>.
But When I run <code>cdk deploy --profile target-env</code>, it appeared:</p>
<pre><code>Need to perform AWS calls for account TARGET_ACCOUNT, but no credentials have been configured.
</code></pre>
<p>I am very confused and don't know how to solve it.
I am a beginner of aws service, thanks advance for helping me!</p>

Shuitian Wei
<p>You need to <a href="https://docs.aws.amazon.com/cdk/latest/guide/bootstrapping.html" rel="nofollow noreferrer">bootstrap</a> all of your (target) accounts to trust the CICD account.</p>
<p>Otherwise, you would have to create and manage the cross-account access by yourself.</p>
<ul>
<li>IAM Roles + Policies (in all accounts)</li>
<li>S3 Bucket for artifacts + bucket policies (in CICD account)</li>
<li>Key Management Service -&gt; Customer Managed Key + Policies to allow the target accounts</li>
</ul>
<p>You can spot here an example architecture, which is applying that:
<img src="https://i.stack.imgur.com/GzMHq.png" alt="enter image description here" /></p>
<p>If it's possible for you, you might switch to the <a href="https://aws.amazon.com/blogs/developer/cdk-pipelines-continuous-delivery-for-aws-cdk-applications/" rel="nofollow noreferrer">CDK Pipelines</a>.
In this guide, also the bootstrapping (incl. trusting) is being applied and every step/resource mentioned from above is being created and properly configured.
It has a few drawbacks as of now, but it's in developer preview and has a quite decent usability and makes your life a lot easier already.</p>
