View a markdown version of this page

IAM permissions for Nitro Sandboxes - Amazon EKS
Encrypted container imagesImage signature verificationKMS attestation conditions
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Help improve this page

To contribute to this user guide, choose the Edit this page on GitHub link that is located in the right pane of every page.

IAM permissions for Nitro Sandboxes

The following IAM permissions are required for specific Nitro Sandboxes features.

Encrypted container images

The pod’s IAM role (through EKS Pod Identity) must have kms:Decrypt permission on the KMS key used to encrypt the image layers. The Nitro Sandbox does not use IRSA credentials for this call:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "kms:Decrypt",
      "Resource": "arn:aws-cn:kms:region-code:111122223333:key/mrk-example"
    }
  ]
}

Image signature verification

For image signature verification, the pod’s IAM role (through EKS Pod Identity) must have the following Amazon Signer permissions:

Action Purpose

signer:GetRevocationStatus

Check whether an individual signing job or certificate has been revoked.

signer:GetSigningProfile

Check whether the signing profile has been revoked with RevokeSigningProfile. Signatures produced by a revoked profile are rejected. Canceled profiles are treated as trusted because CancelSigningProfile is administrative retirement, not trust withdrawal.
Both Signer actions are required

Both actions are required. If either call fails, or returns a permission error, signature verification fails closed and the agent denies container creation. Signature verification also requires network access from the Nitro Sandbox to the Amazon Signer endpoint. Pods with sandbox.amazonaws.com/network-isolated set to "true" cannot use image signature verification.

KMS attestation conditions

To release KMS-protected secrets only to attested sandboxes, add kms:RecipientAttestation:PCR<PCR_ID> conditions to your KMS key policy. Gate on PCR17 (the Cedar policy hash) set to the predicted value from eks-nitro-sandbox-genpolicy, and also add a kms:RecipientAttestation:PCR8:ServiceName condition set to eks.amazonaws.com so that only attestations from the EKS Nitro Sandbox service are accepted. Gating on PCR17 alone is not sufficient:

{
  "Effect": "Allow",
  "Principal": {
    "AWS": "arn:aws-cn:iam::111122223333:role/my-workload-role"
  },
  "Action": "kms:Decrypt",
  "Resource": "*",
  "Condition": {
    "StringEqualsIgnoreCase": {
      "kms:RecipientAttestation:PCR17": "<PCR17-value-from-genpolicy>",
      "kms:RecipientAttestation:PCR8:ServiceName": "eks.amazonaws.com"
    }
  }
}

The eks-nitro-sandbox-genpolicy command prints the predicted PCR17 value when it generates a policy. Use this value to configure your KMS key policy before deploying, without needing a running sandbox.

For more information, see the Amazon KMS documentation on recipient attestation conditions and the Nitro Sandbox security model in Security model and parent instance trust assumptions.