integration with aws iam roles

[mo-saeed]

Hi,

we would like to integrate azure workload identity with aws iam roles so we can access AWS resources from azure AKS pods.

what I tried to do is

• Create IAM provider in AWS with the AZURE AKS cluster issuer url and the audience (api://AzureADTokenExchange)
• Create IAM ROLE with the following trust relationship

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Federated": "arn:aws:iam::ACCOUNT_ID:oidc-provider/AKS_CLUSTER_ISSUER_URL"
            },
            "Action": "sts:AssumeRoleWithWebIdentity",
            "Condition": {
                "StringEquals": {
                    "AKS_CLUSTER_ISSUER_URL":sub": "system:serviceaccount:NAMESPACE_NAME:SERVICE_ACCOUNT_NAME"
                    "AKS_CLUSTER_ISSUER_URL:aud": "api://AzureADTokenExchange"
                }
            }
        }
    ]
}

but unfortunately, the assume role didn't work:

aws sts assume-role-with-web-identity --role-arn arn:aws:iam::ACCOUNT_ID:role/test-azure-identity  --role-session-name test --web-identity-token TOKEN

but i get this error

An error occurred (AccessDenied) when calling the AssumeRoleWithWebIdentity operation: Not authorized to perform sts:AssumeRoleWithWebIdentity

I am not sure what I am doing wrong or if it is anyway possible to do this integration.

Thanks a lot in advance

[aramase]

An error occurred (AccessDenied) when calling the AssumeRoleWithWebIdentity operation: Not authorized to perform sts:AssumeRoleWithWebIdentity

It looks like you don't have necessary permissions to run that command? The error is from the aws sts cli, so I would recommend asking AWS folks.