aws-eks-kubectl run Account issues

[tochi]

I have an IAM account in my root AWS Account. 

This then assumes roles in various other accounts to perform deployment actions, dev, test, shared etc

When pushing the ECR image to a shared AWS account this works fine using the pipe atlassian/aws-ecr-push-image:2.4.2 and the AWS_ROLE_ARN property: 

"arn:aws:iam::$AWS_ECR_ACCOUNT_ID:role/ROLENAME"

However when I use the pipe: atlassian/aws-eks-kubectl-run:2.8.1 to run KUBECTL commands and using the ROLE_ARN property to specify the role to assume:

"arn:aws:iam::$AWS_DEV_ACCOUNT:role/DEV_ROLE_NAME"

The run fails with the following error:

An error occurred (AccessDeniedException) when calling the DescribeCluster operation: User: arn:aws:iam::ROOT-AWS_ACCOUNT:user/deploy-service is not authorized to perform: eks:DescribeCluster on resource: arn:aws:eks:us-east-1:ROOT-AWS_ACCOUNT:cluster/EKS-CLUSTER-NAME

I don't think this is specifically a permissions issue, it seems more like it is not targeting the correct AWS account. The EKS cluster does not exist in the root account but a different one. However it doesn't seem to be switching to the correct AWS account when applying the ROLE_ARN.

I don't see another property in the pipe config to allow me to specify an AWS account to target?

has anyone come across this or have any suggestions?

Thanks

[Igor Stoyanov · Accepted solution]

Hi @tochi . The reason could be that 
aws-ecr-push-image supports assuming role-arn, but aws-eks-kubectl-run currently not.

We will add this feature to aws-eks-kubectl-run pipe and notify you when new version will be released.

Regards, Igor

[tochi]

Thanks, I realized that after reading the source code.

Workaround until this is in place is to have an IAM user with relevant permissions in each target AWS account. 

Thanks

[vikram]

Hi @tochi 

Welcome to Atlassian Community.

Just cross verify your parameters for the assign role (like AWS Credentials), some times the assume role and actual root will be different. 

Just check the below url for knowledge purpose. 

Vikram P

[Igor Stoyanov]

Hi @tochi . 
New version of the pipe released aws-eks-kubectl-run:

Run command 'apply' with the assumed role user ARN.

script:
  - pipe: atlassian/aws-eks-kubectl-run:3.0.0
    variables:
      AWS_ACCESS_KEY_ID: $AWS_ACCESS_KEY_ID
      AWS_SECRET_ACCESS_KEY: $AWS_SECRET_ACCESS_KEY
      AWS_DEFAULT_REGION: $AWS_DEFAULT_REGION
      AWS_ROLE_ARN: 'arn:aws:iam::012349999999:role/my-assumed-role'
      AWS_ROLE_SESSION_NAME: 'my-assumed-role'
      CLUSTER_NAME: 'my-kube-cluster'
      KUBECTL_COMMAND: 'apply'
      RESOURCE_PATH: 'nginx.yml'

Also in case of authentication problem take a look at this article.

Regards, Igor