Support for EKS 'IAM for service accounts' not default [1.11.623, 1.11.653] #2136
Description
Description
Despite the documentation saying a minimum version of 1.11.623 should allow IAM Service Accounts to works, I'm running pods and seeing that that run with the IAM role of the node and not the role linked to the IAM ServiceAccount I am running as.
Another using describes the same problem with 1.11.653 here.
I have discovered a hack that fixes the issue:
// NOTE: For some unknown reason if this call isn't made then the following code
// uses the K8s node's role and not the IAM ServiceAccount role.
// TODO(Jonathon): Remove when the above weirdness is fixed.
val client = AWSSecurityTokenServiceClientBuilder.standard.build
val request = new GetCallerIdentityRequest()
val _ = client.getCallerIdentity(request)
That above identity request returns the correct role, and then subsequently doing something like this, AmazonSNSAsyncClientBuilder.defaultClient(), will get me a client authenticated to the IAM role associated with the service account.