Support AWS EKS IAM Roles

[ghost]

This issue was originally opened by @guidoffm as hashicorp/terraform#24252. It was migrated here as a result of the provider split. The original body of the issue is below.

---

• I want to run Terraform in a pod on AWS Elastic Kubernetes Service (EKS).

• Terraform should write the state to S3.

• Access rights for S3 should be granted to the pod by a service account that is assigned an IAM Role:
  https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html

• To get this working a Go AWS SDK with a version of at least 1.23.13 is required according to https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts-minimum-sdk.html

[ewbankkit]

@guidoffm This should work with the current version of the provider if the AWS_ROLE_ARN and AWS_WEB_IDENTITY_TOKEN_FILE environment variables are set correctly for the pod.
https://docs.aws.amazon.com/eks/latest/userguide/specify-service-account-role.html

[guidoffm]

Do I have to specify the AWS provider version explicitely for this?
If yes Terraform seems to try to contact the Terraform registry which is impossible on our side beacuse there is a proxy needed for this.

[guidoffm]

I tried this:

provider "aws" {
    region = "eu-central-1"
}

terraform {
   required_providers {
    aws = "~> 2.51"
  }

 backend "s3" {
     bucket = "mybucket"
     region = "eu-central-1"
     key = "state.tfstate"
 }
 
}

[mbelang]

I have the exact same issue. I have the same setup for all my apps/addons and only my app that is running terraform is not able to work with the Service Account role.

I had to revert to kube2iam for this one.

aws provider 2.54
terraform 0.12.24

[mbelang]

@guidoffm the aws sdk should be ok https://github.com/terraform-providers/terraform-provider-aws/blob/master/go.mod#L6

[guidoffm]

I am not familiar with Go.

But from

https://github.com/aws/aws-sdk-go#complete-sdk-example

I find that these packages should be included:

  	"github.com/aws/aws-sdk-go/aws"
  	"github.com/aws/aws-sdk-go/aws/awserr"
  	"github.com/aws/aws-sdk-go/aws/request"
  	"github.com/aws/aws-sdk-go/aws/session"
  	"github.com/aws/aws-sdk-go/service/s3"

[guidoffm]

I think we can close this issue here. It is not a problem with the AWS provider but with the core product (remote state).

hashicorp/terraform#24252 should be reopened.

[mbelang]

Are you sure. I have also the error on the lock DynamoDB table too.

[guidoffm]

You find the S3 code here:

https://github.com/hashicorp/terraform/tree/master/backend/remote-state/s3

[eaterm]

I have the same issue. When running terraform in a pod with the service account role.
Terraform doesn't same to use this role.

[bflad]

Sorry about the confusion around this issue being migrated from hashicorp/terraform to here when the original issue related to the Terraform S3 Backend, which lives in the upstream codebase still. I've reopened the upstream issue. Better support for this is in progress now and will land in v0.13.0 upstream for the S3 backend and v3.0.0 in the provider.

[mbelang]

@bflad can you link upstream issue please?

[bflad]

@mbelang relevant links:

• Verify Web Identity Token / EKS IAM Role Service Account (IRSA) via GetSession() Testing aws-sdk-go-base#33
• Support AWS EKS IAM Roles terraform#24252
• backend/s3: Updates for Terraform v0.13.0 terraform#25134
• Update module hashicorp/aws-sdk-go-base to v0.5.0 - autoclosed #13608

[maheshmadpathi]

@guidoffm This should work with the current version of the provider if the AWS_ROLE_ARN and AWS_WEB_IDENTITY_TOKEN_FILE environment variables are set correctly for the pod.
https://docs.aws.amazon.com/eks/latest/userguide/specify-service-account-role.html

Hello @ewbankkit My Terraform Pod has both the Vars but still assumes worker node's role. any idea why?

[bflad]

Hi folks 👋 Version 3.0 of the Terraform AWS Provider will include a few authentication changes that should help in this case including ensuring the EKS pod roles (via the AWS_ROLE_ARN and AWS_WEB_IDENTITY_TOKEN_FILE environment variables) are read before falling back to the EC2 Instance Metadata Service. Similar fixes were applied to the Terraform S3 Backend (part of Terraform CLI) in version 0.13.0-beta2.

The Terraform AWS Provider major version update will release in the next two weeks or so. Please follow the v3.0.0 milestone for tracking the progress of that release. If you are still having trouble after updating when its released, please file a new issue. Thanks!

[ghost]

This has been released in version 3.0.0 of the Terraform AWS provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template for triage. Thanks!

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thanks!