[アップデート] EKS Pod Identity で簡単にクロスアカウントの権限付与ができるようになりました

resource "aws_dynamodb_table" "test-table" {
  provider     = aws.account-b
  name         = "test-dynamodb"
  billing_mode = "PAY_PER_REQUEST"
  hash_key     = "UserId"

  attribute {
    name = "UserId"
    type = "S"
  }
}

data "aws_iam_policy_document" "pod_identity_assume_role_policy" {
  statement {
    effect = "Allow"

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
    }

    actions = ["sts:AssumeRole", "sts:TagSession"]
  }
}

resource "aws_iam_role" "dynamodb_access" {
  provider           = aws.account-b
  name               = "dynamo-db-access-role"
  assume_role_policy = data.aws_iam_policy_document.pod_identity_assume_role_policy.json
}

resource "aws_iam_role_policy_attachment" "dynamodb_access" {
  provider   = aws.account-b
  role       = aws_iam_role.dynamodb_access.name
  policy_arn = "arn:aws:iam::aws:policy/AmazonDynamoDBFullAccess"
}

module "vpc" {
  source  = "terraform-aws-modules/vpc/aws"
  version = "~> 5.17.0"

  name = "eks-vpc"

  cidr = "10.0.0.0/16"

  azs             = ["ap-northeast-1a", "ap-northeast-1c", "ap-northeast-1d"]
  public_subnets  = ["10.0.0.0/24", "10.0.1.0/24", "10.0.2.0/24"]
  private_subnets = ["10.0.100.0/24", "10.0.101.0/24", "10.0.102.0/24"]

  enable_nat_gateway = true
  single_nat_gateway = true
  public_subnet_tags = {
    "kubernetes.io/role/elb" = 1
  }

  private_subnet_tags = {
    "kubernetes.io/role/internal-elb" = 1
  }

}

locals {
  cluster_name                  = "test-cluster"
}

module "eks" {
  source  = "terraform-aws-modules/eks/aws"
  version = "~> 20.37.1"

  cluster_name                    = local.cluster_name
  cluster_version                 = "1.33"
  cluster_endpoint_public_access  = true
  cluster_endpoint_private_access = true

  vpc_id     = module.vpc.vpc_id
  subnet_ids = module.vpc.private_subnets

  enable_cluster_creator_admin_permissions = true

  cluster_compute_config = {
    enabled    = true
    node_pools = ["general-purpose"]
  }

  bootstrap_self_managed_addons = false
}

data "aws_iam_policy_document" "allow_pod_identity" {
  statement {
    effect = "Allow"

    principals {
      type        = "Service"
      identifiers = ["pods.eks.amazonaws.com"]
    }

    actions = [
      "sts:AssumeRole",
      "sts:TagSession"
    ]
  }
}

resource "aws_iam_role" "app" {
  name               = "app-sa-role"
  assume_role_policy = data.aws_iam_policy_document.allow_pod_identity.json
}

resource "aws_iam_role_policy_attachment" "app" {
  role       = aws_iam_role.app.name
  policy_arn = aws_iam_policy.assume_role_policy.arn
}

data "aws_iam_policy_document" "assume_role_policy" {
  statement {
    effect = "Allow"
    actions = ["sts:AssumeRole", "sts:TagSession"]
    resources = [aws_iam_role.dynamodb_access.arn]
  }
}

resource "aws_iam_policy" "assume_role_policy" {
  name   = "assume-role-policy"
  policy = data.aws_iam_policy_document.assume_role_policy.json
}

aws eks update-kubeconfig --name test-cluster

% kubectl create ns app
namespace/app created

% kubectl create sa app-sa -n app
serviceaccount/app-sa created

from fastapi import FastAPI
import boto3

app = FastAPI()

@app.get("/")
def read_root():
    dynamodb = boto3.client("dynamodb", region_name="ap-northeast-1")
    response = dynamodb.scan(
        TableName="test-dynamodb",
    )
    return response["Items"]

apiVersion: apps/v1
kind: Deployment
metadata:
  namespace: app
  name: fast-api
spec:
  selector:
    matchLabels:
      app.kubernetes.io/name: fast-api
  replicas: 1
  template:
    metadata:
      labels:
        app.kubernetes.io/name: fast-api
    spec:
      serviceAccountName: app-sa
      containers:
        - image: xxxxxxxxxxxx.dkr.ecr.ap-northeast-1.amazonaws.com/fast-api-app:v3
          imagePullPolicy: Always
          name: fast-api
          ports:
            - containerPort: 80
          resources:
            requests:
              cpu: "0.5"

apiVersion: v1
kind: Service
metadata:
  namespace: app
  name: fast-api
spec:
  ports:
    - port: 80
      targetPort: 80
      protocol: TCP
  type: NodePort
  selector:
    app.kubernetes.io/name: fast-api

apiVersion: networking.k8s.io/v1
kind: IngressClass
metadata:
  namespace: app
  labels:
    app.kubernetes.io/name: LoadBalancerController
  name: alb
spec:
  controller: eks.amazonaws.com/alb

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  namespace: app
  name: fast-api-ingress
  annotations:
    alb.ingress.kubernetes.io/scheme: internet-facing
    alb.ingress.kubernetes.io/target-type: ip
spec:
  ingressClassName: alb
  rules:
    - http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: fast-api
                port:
                  number: 80

% curl http://k8s-app-fastapii-821882c6be-1557614806.ap-northeast-1.elb.amazonaws.com
[{"UserId":{"S":"1"},"Name":{"S":"Taro"}}]