aws / aws/aws-cli

Assuming IAM role from within a EKS Pod Identity-enabled container does not work using named profile

Open
#8,912 22 comments 8 reactions 0 assignees View on GitHub
bug eks p2
Dominant language
Python
Stars
17.3k
Forks
4.6k
Avg merge
1d 2h
Merged PRs (30d)
13

Description

### Describe the bug

When working on a pod in EKS with Pod Identity assigned, it is not possible to assume another role using `~/.aws/config` and profiles.

When specifying `role_arn` in `~/.aws/config`, it is required to provide `source_profile` or `credential_source`. Since we are in the pod, `source_profile` is not an option. Unfortunately `credential_source` is pretty limited:
* `Environment` value does not work as there is no env variables
* `Ec2InstanceMetadata` points to the IAM role attached to the EC2, Pod Identity is not being used
* `EcsContainer` is for ECS

### Expected Behavior

It should be possible to instruct `aws-cli` to use EKS Pod Identity as a `credential_source`.

### Current Behavior

It is not possible to utilize `aws-cli` with Assume Role mechanism using named profiles within `~/.aws/config` when working on a EKS Pod Identity-enabled pods.

### Reproduction Steps

1. Create EKS with Pod Identity agent
2. Assign `sts:assumeRole` permission to the pod
3. Prepare IAM role to be assumed
4. Create the pod with the Pod Identity assigned, prepare `~/.aws/config`
5. Try to assume a different IAM role using `aws --profile`

### Possible Solution

_No response_

### Additional Information/Context

_No response_

### CLI version used

2.15.57

### Environment details (OS name and version, etc.)

aws-cli/2.15.57 Python/3.12.6 Linux/6.8.0-41-generic source/x86_64.alpine.3

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.