Summary
In this chapter, we explored how AWS API permissions can be assigned to EC2 instances (worker nodes) and Pods using instance profiles and IMDS. We also noted that by default, EKS Pods inherit the permissions assigned to the worker nodes they run on, and how this may not be a good thing, as we are not observing a least-privilege model since many Pods may not need any AWS API access.
We discussed how IMDSv2 can be used to reduce the use of worker permission and should be used with IRSA to limit the worker node permission inheritance. We then worked through how to configure and use IRSA from the command line and how IaC tools such as eksctl can simplify the process significantly. Finally, we looked at how to do some basic troubleshooting of AWS IAM permission issues, working backward from the Kubernetes SA.
In the next chapter, we will look at how we can use AWS load balancers to make our Kubernetes services more resilient and scalable.
