aws eks in external-secret AccessDenied error

Question

there.
Eks is trying to use external-secret, but an associated error occurs.

{"level":50,"message_time":"2021-08-17T14:01:55.862Z","pid":17,"hostname":"knowre-kubernetes-external-secrets-68dff667d9-t9zvs","payload":{"message":"Missing credentials in config, if using AWS_CONFIG_FILE, set AWS_SDK_LOAD_CONFIG=1","code":"CredentialsError","time":"2021-08-17T14:01:55.862Z","requestId":"44fceebd-67df-47d6-89a7-8d8470326d87","statusCode":403,"retryable":false,"retryDelay":71.51677548097439,"originalError":{"message":"Could not load credentials from ChainableTemporaryCredentials","code":"CredentialsError","time":"2021-08-17T14:01:55.862Z","requestId":"44fceebd-67df-47d6-89a7-8d8470326d87","statusCode":403,"retryable":false,"retryDelay":71.51677548097439,"originalError":{"message":"User: arn:aws:sts::*******:assumed-role/eks-node/i-0f522dc3109b24248 is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::*****:role/external-secret","code":"AccessDenied","time":"2021-08-17T14:01:55.862Z","requestId":"44fceebd-67df-47d6-89a7-8d8470326d87","statusCode":403,"retryable":false,"retryDelay":71.51677548097439}}},"msg":"failure while polling the secret management/external-secret"}

All privileges granted admin privileges.
This is my yaml.

spec:
  backendType: systemManager
  # optional: specify role to assume when retrieving the data
  roleArn: arn:aws:iam::********:role/external-secret
  # optional: specify region
  region: ap-northeast-2
  data:
    - key: EKS_TEST
      name: test

--

      imagePullPolicy: IfNotPresent
      resources:
        {}
      env:
      - name: "AWS_REGION"
        value: "ap-northeast-2"
      - name: "POLLER_INTERVAL_MILLISECONDS"
        value: "15000"
    
      # Params for env vars populated from k8s secrets
  securityContext:
    fsGroup: 65534
    runAsNonRoot: false

Authorized oidc and established the trust of aws role.

user_5765964 · Answer

The External Secret Operator, creates service account by default, check helm-chart values

So, the issue here could be service account may not have sufficient privilege i.e.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "secretsmanager:GetResourcePolicy",
        "secretsmanager:GetSecretValue",
        "secretsmanager:DescribeSecret",
        "secretsmanager:ListSecretVersionIds"
      ],
      "Resource": [
        "arn:aws:secretsmanager:us-west-2:111122223333:secret:dev-*",
      ]
    }
  ]
}

You can create a role and specify role during installation using supported helm-chart values i.e.

serviceAccount:
  # Specifies whether a service account should be created
  create: true
  # Specifies annotations for this service account
  annotations: 
    eks.amazonaws.com/role-arn: arn:aws:iam::ACCOUNT_ID:role/IAM_ROLE_NAME
  # The name of the service account to use.
  # If not set and create is true, a name is generated using the fullname template
  name: my-service-account

P.S. This project has been deprecated. I would recommend migrating to external-secrets.

aws eks in external-secret AccessDenied error

1 Answers