aws / aws/aws-cloud-map-mcs-controller-for-k8s

Cross AWS account support

Open
#111 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
98
Forks
32
PR merge metrics
No merged PRs in 30d

Description

See #105

To better support cross account scenarios, we can add the ability to assume a cross-account role to the controller. Implementation wise, it would be a [credential provider](https://pkg.go.dev/github.com/aws/aws-sdk-go-v2/credentials/stscreds) that assumes the role specified by an environment variable set on the container.

Once code change is in. Customer would take the follow steps to enable:
1. Customer creates role in AWS account with permissions to Cloud Map. Role is configured to be assumed by other account.
2. Customer adds permissions for EKS pod role to assume the role created in step 1.
3. Customer sets environment variable on controller with arn of role to assume.

Contributor guide

Open the contributing guide

Research direction

Start by reading the controller's AWS client and credential setup, then review the linked aws-sdk-go-v2 stscreds credential provider. Trace how the controller accesses AWS Cloud Map and identify where the role ARN environment variable should be consumed. Done means the controller can use the assumed cross-account role for Cloud Map access and the documented three-step AWS configuration works.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, go, kubernetes
Domain
cloud, devops
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.