Configure AWS IAM for Connections
Overview
In Cinchy v5.6, you are now able to run the Connections pod under a service account that uses an AWS IAM (Identity and Access Management) role, which is an IAM identity that you can create to have specific permissions and access to your AWS resources. To set up AWS IAM role authentication, please review the procedure below.
AWS IAM role authentication
To check that you have an OpenID Connect set up with the cluster (the default for deployments made using the Cinchy automation process), run the below command within a terminal:
The output should appear like the below. Make sure to note this down for later use.
Log in to your AWS account and create an IAM Role policy through the AWS UI. Ensure that it has S3 access.
Run the below command in a terminal to create a service account with the role created in step 3. If your cluster has a special character like an underscore, skip to the next section.
Cluster names with special characters
If your cluster name has a special character, like an underscore, you will need to create and apply the YAML. Follow section 1 up until step 4, and then follow the below procedure.
In an IDE (Visual Studio, VsCode), create a new file titled
my-service-account.yaml
in your working directory. It should contain the below content.
In a terminal, run the below command:
In an IDE (Visual Studio, VsCode), create a new file titled
trust-relationship.json
in your working directory. It should contain the below content.
For example:
Execute the following command to create the role, referencing the above .json file:
For example:
Execute the following command to attach the IAM policy to your role:
For example:
Execute the following command to annotate your service account with the Amazon Resource Name (ARN) of the IAM role that you want the service account to assume:
For example:
Confirm that the role and service account are correctly configured by verifying the output of the following commands:
Authorize for Data Syncs
To ensure that the Connections pod's role has the correct permissions, the role specified by the user in AWS must have its Trusted Relationships configured as such:
Confirmation
To confirm that the Connections app is using the service account:
Navigate to the cinchy.kubernetes repository >
connections/kustomization.yaml
fileExecute the following:
From a terminal, run the below command:
The output should look like the following:
![](https://platform.docs.cinchy.com/~gitbook/image?url=https%3A%2F%2F3728216363-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FuXTzhcF5GwEVWPr9Y2dX%252Fuploads%252FZgLKpfOQT4Ug4F3GZ1ST%252Fimage.png%3Falt%3Dmedia%26token%3Ddce498c6-3f7a-4a33-8ec7-5caf17352561&width=768&dpr=4&quality=100&sign=21f9b824&sv=1)
Last updated