Flesh out more Auth Federation details about aws-eks-best-practices HOT 7 OPEN

Note to self: include aws-iam-authenticator flags.

from aws-eks-best-practices.

• Federate with AWS using AWS SSO
• If running AD on premises can use AD Connector to establish an association with AD otherwise use AWS Managed AD.
• Create Permission Set for groups imported from AD

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "sts:AssumeRole",
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": "eks:DescribeCluster",
            "Resource": "arn:aws:eks:us-east-1:123456789012:cluster/<clustername>"
        }
    ]
}

Above policy allows user to assume an AWS role and create a kubeconfig file using aws eks update-kubeconfig CLI command for cluster .
SSO will automatically create AWS IAM roles for imported groups. Each role will start with AWSReservedSSO_

• Update aws-auth ConfigMap with roles and their corresponding RBAC group

- rolearn: arn:aws:iam::123456789012:role/AWSReservedSSO_AD-EKS-Admins_7ab7b31734ed2731
  username: adminuser:{{SessionName}}
  groups:
  - default:ad-eks-admins

• Create Roles and RoleBindings or ClusterRole and ClusterRoleBindings for the federated users, for example:

kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: eks-admins-binding
  namespace: default
subjects:
  - kind: Group
    apiGroup: rbac.authorization.k8s.io
    name: 'default:ad-eks-admins'
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: 'default:ad-eks-admins'

• Install AWS CLI 2.0 and configure SSO profile: aws sso configure
• Login using federated credentials: aws sso login --profile <profilename>
• execute kubectl commands
  Actions by the federated user will appear in the audit log.

fields @timestamp, @message
| filter user.username = "adminuser:jicowan-CORP.NETPOL.COM"
| sort @timestamp desc
| limit 20

"user": {
        "username": "adminuser:jicowan-CORP.NETPOL.COM",
        "uid": "heptio-authenticator-aws:123456789012:AROA36C6WWEJ5VZX5PAXY",
        "groups": [
            "default:ad-eks-admins",
            "system:authenticated"
        ],
        "extra": {
            "accessKeyId": [
                "ASIA36C6WWEJY5KK2H3X"
            ]
        }

from aws-eks-best-practices.

@ikester, is this what you were thinking of? this is already pretty well documented in this blog.

from aws-eks-best-practices.

It seems a very old article and i think aws-iam-authenticator functionality was already in aws cli so no more seperate cli command?

from aws-eks-best-practices.

@os-virtualretail yes, it needs updating. I don't think it accounts for the new SSO functionality in the AWS CLI v2. This dramatically improves the user experience for federated users because they no longer have to use a script or call assume-role before using kubectl. Do you have an opinion about what the best practice ought to be here?

from aws-eks-best-practices.

@ikester any feedback?

from aws-eks-best-practices.

I found this article to be very useful.

from aws-eks-best-practices.