aws / aws/containers-roadmap

[EKS] [request]: Automated OIDC registration in IAM Identity Provider

Open
#1,233 1 comment 17 reactions 0 assignees View on GitHub
EKS Proposed
Dominant language
Shell
Stars
5.4k
Forks
334
PR merge metrics
No merged PRs in 30d

Description

### Community Note

* Please vote on this issue by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original issue to help the community and maintainers prioritize this request
* Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
* If you are interested in working on this issue or have submitted a pull request, please leave a comment

**Tell us about your request**
Register EKS OIDC endpoint in IAM Identity Provider automatically while new cluster is created.

**Which service(s) is this request for?**
EKS

**Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard?**
Configure EKS OIDC endpoint in IDP is a must for Pods (running by k8s service account) to access AWS resources protected by IAM roles/policies. However, my organization does not allow DevOps team to access IAM Identity Provider dynamically due to security concerns. AWS document also mentions: "The trust for the OIDC provider is derived from the IAM provider that this operation creates. Therefore, it is best to limit access to the CreateOpenIDConnectProvider operation to highly privileged users." We would like to see EKS automatically creates the link when a new cluster is created so we don't need extra step to register the OIDC endpoint in IDP.

**Are you currently working around this issue?**
Currently we have contact cloud admins with high privilege to create OIDC entry in IDP manually.

**Additional context**
With highly automated IaC, this additional step is not favourable and it will cause additional delay in disaster recovery scenarios.

**Attachments**
If you think you might have additional information that you'd like to include via an attachment, please do - we'll take a look. (Remember to remove any personally-identifiable information.)

Contributor guide

Open the contributing guide

Research direction

The request concerns EKS cluster creation and registration of an OIDC endpoint in IAM; no repository files, tests, or entry points are named. Start by reviewing the AWS EKS and IAM OIDC-provider documentation and the repository's roadmap conventions. Done means defining and implementing a secure automated registration flow that removes the manual administrator step without weakening access controls.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, kubernetes
Domain
authentication, cloud, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.