aws / aws/aws-cloud-map-mcs-controller-for-k8s
Cross AWS account support
- Dominant language
- Go
- Stars
- 98
- Forks
- 32
- PR merge metrics
- No merged PRs in 30d
Description
See #105
To better support cross account scenarios, we can add the ability to assume a cross-account role to the controller. Implementation wise, it would be a [credential provider](https://pkg.go.dev/github.com/aws/aws-sdk-go-v2/credentials/stscreds) that assumes the role specified by an environment variable set on the container.
Once code change is in. Customer would take the follow steps to enable:
1. Customer creates role in AWS account with permissions to Cloud Map. Role is configured to be assumed by other account.
2. Customer adds permissions for EKS pod role to assume the role created in step 1.
3. Customer sets environment variable on controller with arn of role to assume.
Contributor guide
Research direction
Start by reading the controller's AWS client and credential setup, then review the linked aws-sdk-go-v2 stscreds credential provider. Trace how the controller accesses AWS Cloud Map and identify where the role ARN environment variable should be consumed. Done means the controller can use the assumed cross-account role for Cloud Map access and the documented three-step AWS configuration works.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, go, kubernetes
- Domain
- cloud, devops
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100