• IAM Role auth support in AWS targets:

  • Comprehend
  • DynamoDB
  • EventBridge
  • Kinesis
  • Lambda
  • S3
  • SNS
  • SQS

  Resolves Support IAM role auth in AWS targets #1238

• BREAKING CHANGE: All AWS target CRDs are updated to match AWS Sources' auth structure.
  Should be mentioned in the release note when merged (cc @sameersbn).

  Before:

  apiVersion: targets.triggermesh.io/v1alpha1
  kind: AWS*
  spec:
    ...
    awsApiKey:
      secretKeyRef:
        name: aws
        key: AWS_ACCESS_KEY_ID
    awsApiSecret:
      secretKeyRef:
        name: aws
        key: AWS_SECRET_ACCESS_KEY
  

  After:

  apiVersion: targets.triggermesh.io/v1alpha1
  kind: AWS*
  spec:
    ...
    auth:
      credentials:
        accessKeyID:
          valueFromSecret:
            name: aws
            key: AWS_ACCESS_KEY_ID
        secretAccessKey:
          valueFromSecret:
            name: aws
            key: AWS_SECRET_ACCESS_KEY
  

  Hence, IAM role auth is now available as:

  apiVersion: targets.triggermesh.io/v1alpha1
  kind: AWS*
  spec:
    ...
    auth:
      iamRole: arn:aws:iam::<redacted>:role/<role-name>
  

  Resolves AWS Spec Credentials Should Match in Targets and Sources #1114

Note for Docs (cc @jmcx)

After this PR is merged and released, all AWS Target docs and samples should be updated according to the "Before/After" example above.

Here is a draft "EKS IAM Role auth" instruction:

TriggerMesh AWS Sources and Targets on EKS support authentication based on IAM Roles. Authentication configuration consists of two simple steps: enable OIDC provider for EKS cluster and create IAM Role. There are several different ways to make these configuration steps, but in this instruction, we'll go with the CLI tools: aws and eksctl (installation).

Enabling OIDC provider:

eksctl utils associate-iam-oidc-provider --cluster my-cluster --approve

We'll use AWS S3 target as an example for this instruction. All other targets are configured in the same manner with corresponding resource updates in IAM policies.

Create IAM policy file with full access to S3 bucket test-bucket:

cat >aws-s3-target-policy.json <<EOF
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "*",
            "Resource": "arn:aws:s3:::test-bucket"
        }
    ]
}
EOF

Create the policy from this file:

aws iam create-policy --policy-name aws-s3-target-policy --policy-document file://aws-s3-target-policy.json

Set account variables:

account_id=$(aws sts get-caller-identity --query "Account" --output text)
oidc_provider=$(aws eks describe-cluster --name <my-cluster> --region <aws-region> --query "cluster.identity.oidc.issuer" --output text | sed -e "s/^https:\/\///")

-replace <my-cluster> and <aws-region> with your EKS cluster values.

Create role's trust relationship file:

cat >trust-relationship.json <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Federated": "arn:aws:iam::$account_id:oidc-provider/$oidc_provider"
      },
      "Action": "sts:AssumeRoleWithWebIdentity",
      "Condition": {
        "StringEquals": {
          "$oidc_provider:aud": "sts.amazonaws.com"
        }
      }
    }
  ]
}
EOF

Create role:

aws iam create-role --role-name aws-s3-target-role --assume-role-policy-document file://trust-relationship.json --description "TriggerMesh AWS S3 Target role"

This command should return JSON with the role details; Arn field value is what we'll use in our target later on.

Attach the policy to the role:

aws iam attach-role-policy --role-name aws-s3-target-role --policy-arn=arn:aws:iam::$account_id:policy/aws-s3-target-policy

At this point, IAM configuration is done, and we can create AWS S3 Target using our new Role:

kubectl apply -f - <<EOF
apiVersion: targets.triggermesh.io/v1alpha1
kind: AWSS3Target
metadata:
  name: triggermesh-aws-s3-test
spec:
  adapterOverrides:
    public: true
  arn: arn:aws:s3:::test-bucket
  auth:
    iamRole: <role arn>
EOF

After S3 target is created, it can be used as a Sink for other event sources or accessed directly via a public URL if the network's external endpoints are configured.

The official document used for this instruction is here.
The configuration process (IAM policies, roles, resources) may vary depending on the AWS target used and cluster security requirements.