Assuming IAM role from within a EKS Pod Identity-enabled container does not work using named profile
- Dominant language
- Python
- Stars
- 17.3k
- Forks
- 4.6k
- Avg merge
- 1d 2h
- Merged PRs (30d)
- 13
Description
### Describe the bug
When working on a pod in EKS with Pod Identity assigned, it is not possible to assume another role using `~/.aws/config` and profiles.
When specifying `role_arn` in `~/.aws/config`, it is required to provide `source_profile` or `credential_source`. Since we are in the pod, `source_profile` is not an option. Unfortunately `credential_source` is pretty limited:
* `Environment` value does not work as there is no env variables
* `Ec2InstanceMetadata` points to the IAM role attached to the EC2, Pod Identity is not being used
* `EcsContainer` is for ECS
### Expected Behavior
It should be possible to instruct `aws-cli` to use EKS Pod Identity as a `credential_source`.
### Current Behavior
It is not possible to utilize `aws-cli` with Assume Role mechanism using named profiles within `~/.aws/config` when working on a EKS Pod Identity-enabled pods.
### Reproduction Steps
1. Create EKS with Pod Identity agent
2. Assign `sts:assumeRole` permission to the pod
3. Prepare IAM role to be assumed
4. Create the pod with the Pod Identity assigned, prepare `~/.aws/config`
5. Try to assume a different IAM role using `aws --profile`
### Possible Solution
_No response_
### Additional Information/Context
_No response_
### CLI version used
2.15.57
### Environment details (OS name and version, etc.)
aws-cli/2.15.57 Python/3.12.6 Linux/6.8.0-41-generic source/x86_64.alpine.3
Contributor guide
Assessment
This issue has not been assessed yet.