Use IRSA with the Amazon SDK

Using the credentials

To use the credentials from IAM roles for service accounts (IRSA), your code can use any Amazon SDK to create a client for an Amazon service with an SDK, and by default the SDK searches in a chain of locations for Amazon Identity and Access Management credentials to use. The IAM roles for service accounts credentials will be used if you don’t specify a credential provider when you create the client or otherwise initialized the SDK.

This works because IAM roles for service accounts have been added as a step in the default credential chain. If your workloads currently use credentials that are earlier in the chain of credentials, those credentials will continue to be used even if you configure an IAM roles for service accounts for the same workload.

The SDK automatically exchanges the service account OIDC token for temporary credentials from Amazon Security Token Service by using the AssumeRoleWithWebIdentity action. Amazon EKS and this SDK action continue to rotate the temporary credentials by renewing them before they expire.

When using IAM roles for service accounts, the containers in your Pods must use an Amazon SDK version that supports assuming an IAM role through an OpenID Connect web identity token file. Make sure that you’re using the following versions, or later, for your Amazon SDK:

Many popular Kubernetes add-ons, such as the Cluster Autoscaler, the Route internet traffic with Amazon Load Balancer Controller, and the Amazon VPC CNI plugin for Kubernetes support IAM roles for service accounts.

To ensure that you’re using a supported SDK, follow the installation instructions for your preferred SDK at Tools to Build on Amazon when you build your containers.

Considerations

Java

When using Java, you must include the sts module on the classpath. For more information, see WebIdentityTokenFileCredentialsProvider in the Java SDK docs.