Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Feature request] Support for custom Session Tags and Session Name #14

Open
taraspos opened this issue Aug 2, 2024 · 2 comments
Open

Comments

@taraspos
Copy link
Contributor

taraspos commented Aug 2, 2024

Feature request

Ability to configure Custom Session Tags and Custom Session Names for STS sessions created by EKS Pod Identities.

Context

Currently it's not possible to configure neither Custom Session Tags1 nor Custom Session Name2.

This makes it impossible to implement certain use-cases where I need to configure IAM policies based on custom IDs, rather than supported values of:

  • eks-cluster-arn
  • eks-cluster-name
  • kubernetes-namespace
  • kubernetes-service-account
  • kubernetes-pod-name
  • kubernetes-pod-uid

Also, existing session tags consume more than a half of STS packedPolicySize, would be great to be able to optionally disable some tags, to reduce policy size:

Footnotes

  1. https://docs.aws.amazon.com/eks/latest/userguide/pod-id-abac.html#pod-id-abac-custom-tags

  2. https://github.com/aws/containers-roadmap/issues/2362

@taer
Copy link

taer commented Sep 10, 2024

This also helps with MSK's IAM policy. The MSK server gets angry and de-auths you when your session name changes. So your MSK connection is alive and well for the initial X hours. When pod-identtity-agent assumes a NEW STS role when the old expires, the session name changes, which causes MSK to kick you out. The error you get is about principals changing. The fix is to set AWS_ROLE_SESSION_NAME, which isn't possible w/ pod-identity

aws/aws-msk-iam-auth#104

@taer
Copy link

taer commented Sep 10, 2024

linking to aws roadmap in case it helps aws/containers-roadmap#2362

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants