aws-samples / aws-samples/eks-single-button-aws-alb-addon-installation
Incorrect LoadBalancer Controller IAM Role Condition
- Dominant language
- Python
- Stars
- 1
- Forks
- 2
- PR merge metrics
- No merged PRs in 30d
Description
Hi, I tried this template because I was wondering if it was possible to write a federated IAM role with conditions using a yaml template and not json. But i think the value of Region and OIDCProviderID inside the StringEquals conditon:
```
AssumeRolePolicyDocument:
Version: '2012-10-17'
Statement:
- Effect: Allow
Principal:
Federated: !Sub arn:aws:iam::${AccountID}:oidc-provider/oidc.eks.${Region}.amazonaws.com/id/${OIDCProviderID}
Action: sts:AssumeRoleWithWebIdentity
Condition:
StringEquals:
oidc.eks.${Region}.amazonaws.com/id/${OIDCProviderID}:aud: sts.amazonaws.com #HERE
oidc.eks.${Region}.amazonaws.com/id/${OIDCProviderID}:sub: system:serviceaccount:kube-system:aws-load-balancer-controller #HERE
```
are not replaced correctly due to the lack of a Fn::Sub.
is it possible to continue using the yaml format or is it necessary to switch to a json format as below?
```
AssumeRolePolicyDocument: !Sub |
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Federated": "arn:aws:iam::${AWS::AccountId}:oidc-provider/oidc.eks.${AWS::Region}.amazonaws.com/id/${OIDCProviderID}"
},
"Action": "sts:AssumeRoleWithWebIdentity",
"Condition": {
"StringEquals": {
"oidc.eks.${AWS::Region}.amazonaws.com/id/${OIDCProviderID}:aud": "sts.amazonaws.com"
"oidc.eks.${AWS::Region}.amazonaws.com/id/${OIDCProviderID}:sub": "system:serviceaccount:kube-system:aws-load-balancer-controller"
}
}
}
]
}
```
Thank you!
Contributor guide
Assessment
This issue has not been assessed yet.