aws-eks-irsa-role-trusts-oidc-issuer
An IAM role whose trust policy Federated principal matches an EKS cluster OIDC issuer URL trusts that cluster's projected SA tokens.
match (record)
{
"field": "AssumeRolePolicyDocument",
"resource_type": "AWS::IAM::Role"
}
where
Statement[].Action includes sts:AssumeRoleWithWebIdentity
Statement[].Principal.Federated matches oidc.eks.<region>.amazonaws.com/id/<cluster-id> (an AWS::IAM::OIDCProvider ARN registered for an EKS cluster)
emit
| source type | Role |
|---|---|
| source | <IAM Role> |
| target | <ExternalIdentity / FederatedIdentity representing the cluster OIDC issuer> |
Narrative
IAM role {role.name} trusts EKS cluster OIDC issuer {issuer.name} (Federated principal in trust policy) with Action sts:AssumeRoleWithWebIdentity. Sub condition: {trust_condition_sub}. Pinned: {pinned}.
Raw rule rules/explicit/aws-eks.yaml
id: aws-eks-irsa-role-trusts-oidc-issuer
emits: TrustsExternalIdentity
description: An IAM role whose trust policy Federated principal matches an EKS cluster OIDC issuer URL
trusts that cluster's projected SA tokens.
match_record:
resource_type: AWS::IAM::Role
field: AssumeRolePolicyDocument
where:
- Statement[].Action includes sts:AssumeRoleWithWebIdentity
- Statement[].Principal.Federated matches oidc.eks.<region>.amazonaws.com/id/<cluster-id> (an AWS::IAM::OIDCProvider
ARN registered for an EKS cluster)
emit:
source_type: Role
source: <IAM Role>
target: <ExternalIdentity / FederatedIdentity representing the cluster OIDC issuer>
api_source: iam:GetRole
evidence_field: AssumeRolePolicyDocument.Statement[].Principal.Federated
properties:
trust_condition_sub: <value of StringEquals/StringLike condition on token.sub>
trust_condition_aud: <value of StringEquals/StringLike condition on token.aud>
pinned: <true if sub is pinned to a specific system:serviceaccount:ns:sa; false if wildcard>
narrative: 'IAM role {role.name} trusts EKS cluster OIDC issuer {issuer.name} (Federated principal in
trust policy) with Action sts:AssumeRoleWithWebIdentity. Sub condition: {trust_condition_sub}. Pinned:
{pinned}.'