Access from within EKS from another account still results in Access Denied

[jeffbeagley]

I have the following resources in Account A:

• kubernetes service account
• service account has annotation for an IAM role within Account A
• IAM Role has allow action for sts:AssumeRole of the Role in Account B

Account B has the following:

• your CloudFormation template with principal set to IAM Role from Account A

I provided the External ID and new IAM Role's ARN from Account B into Grafana that is running within Account A and I still receive the following

User: arn:aws:sts::<accountA>:assumed-role/monitoring-role/<session> is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::<AccountB>:role/monitoring-role-dev

Have you gotten this to work from EKS?

[jangaraj]

EKS is different. You need different trust - https://docs.aws.amazon.com/eks/latest/userguide/associate-service-account-role.html

[AlKapkone]

Hi, @jangaraj @jeffbeagley
I also wanted to assume a remote role in Account A from the Grafana pod deployed in the EKScluster in Account B
But have the same issue.
I used these docs but they don't work - https://docs.aws.amazon.com/eks/latest/userguide/associate-service-account-role.html
Do you have any ideas ?

CloudWatch metrics query failed: AccessDenied: User: arn:aws:sts::123456789:assumed-role/ondemand-eks-node-group/i-fdksfkdsfdfdsfds is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::987654321:role/grafana-cross-account-role status code: 403

[AlKapkone]

I annotated my service account with a remote role:

Annotations:         eks.amazonaws.com/role-arn: arn:aws:iam::987654321:role/grafana-cross-account-role

And in account A configured IAM role and OIDC provider for my EKS cluster:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Federated": "arn:aws:iam::111122223333:oidc-provider/oidc.eks.region-code.amazonaws.com/id/EXAMPLED539D4633E53DE1B71EXAMPLE"
            },
            "Action": "sts:AssumeRoleWithWebIdentity",
            "Condition": {
                "StringEquals": {
                    "oidc.eks.region-code.amazonaws.com/id/EXAMPLED539D4633E53DE1B71EXAMPLE:sub": "system:serviceaccount:default:my-service-account",
                    "oidc.eks.region-code.amazonaws.com/id/EXAMPLED539D4633E53DE1B71EXAMPLE:aud": "sts.amazonaws.com"
                }
            }
        }
    ]
}