nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

aws-eks-kubectl run Account issues

tochi_ehmr1j

I have an IAM account in my root AWS Account.

This then assumes roles in various other accounts to perform deployment actions, dev, test, shared etc

When pushing the ECR image to a shared AWS account this works fine using the pipe atlassian/aws-ecr-push-image:2.4.2 and the AWS_ROLE_ARN property:

"arn:aws:iam::$AWS_ECR_ACCOUNT_ID:role/ROLENAME"

However when I use the pipe: atlassian/aws-eks-kubectl-run:2.8.1 to run KUBECTL commands and using the ROLE_ARN property to specify the role to assume:

"arn:aws:iam::$AWS_DEV_ACCOUNT:role/DEV_ROLE_NAME"

The run fails with the following error:

An error occurred (AccessDeniedException) when calling the DescribeCluster operation: User: arn:aws:iam::ROOT-AWS_ACCOUNT:user/deploy-service is not authorized to perform: eks:DescribeCluster on resource: arn:aws:eks:us-east-1:ROOT-AWS_ACCOUNT:cluster/EKS-CLUSTER-NAME

I don't think this is specifically a permissions issue, it seems more like it is not targeting the correct AWS account. The EKS cluster does not exist in the root account but a different one. However it doesn't seem to be switching to the correct AWS account when applying the ROLE_ARN.

I don't see another property in the pipe config to allow me to specify an AWS account to target?

has anyone come across this or have any suggestions?

Thanks

Accepted answers

Igor Stoyanov

Hi @tochi . The reason could be that
aws-ecr-push-image supports assuming role-arn, but aws-eks-kubectl-run currently not.

We will add this feature to aws-eks-kubectl-run pipe and notify you when new version will be released.

Regards, Igor

All comments

vikram_eupqsc

Hi @tochi

Welcome to Atlassian Community.

Just cross verify your parameters for the assign role (like AWS Credentials), some times the assume role and actual root will be different.

Just check the below url for knowledge purpose.

Vikram P

Igor Stoyanov

Hi @tochi . The reason could be that
aws-ecr-push-image supports assuming role-arn, but aws-eks-kubectl-run currently not.

We will add this feature to aws-eks-kubectl-run pipe and notify you when new version will be released.

Regards, Igor

tochi_ehmr1j

Thanks, I realized that after reading the source code.

Workaround until this is in place is to have an IAM user with relevant permissions in each target AWS account.

Thanks

Igor Stoyanov

Hi @tochi .
New version of the pipe released aws-eks-kubectl-run:

Run command 'apply' with the assumed role user ARN.

script:
  - pipe: atlassian/aws-eks-kubectl-run:3.0.0
    variables:
      AWS_ACCESS_KEY_ID: $AWS_ACCESS_KEY_ID
      AWS_SECRET_ACCESS_KEY: $AWS_SECRET_ACCESS_KEY
      AWS_DEFAULT_REGION: $AWS_DEFAULT_REGION
      AWS_ROLE_ARN: 'arn:aws:iam::012349999999:role/my-assumed-role'
      AWS_ROLE_SESSION_NAME: 'my-assumed-role'
      CLUSTER_NAME: 'my-kube-cluster'
      KUBECTL_COMMAND: 'apply'
      RESOURCE_PATH: 'nginx.yml'

Also in case of authentication problem take a look at this article.

Regards, Igor

Welcome!

It looks like you're new here. Sign in or register to get started.

Quick Links

Find more posts tagged with

cloud

bitbucket

bitbucket-cloud

bitbucket-pipelines

aws

kubernetes

pipes

eks