aws-eks-pod-identity-role-trusts-pods
An IAM role whose trust policy Service principal includes pods.eks.amazonaws.com is eligible for EKS Pod Identity associations.
match (record)
{
"field": "AssumeRolePolicyDocument",
"resource_type": "AWS::IAM::Role"
}
where
Statement[].Action includes sts:AssumeRoleWithWebIdentity
Statement[].Principal.Service includes pods.eks.amazonaws.com
emit
| source type | Role |
|---|---|
| source | <IAM Role> |
| target | <FederatedIdentity representing pods.eks.amazonaws.com> |
Narrative
IAM role {role.name} trusts pods.eks.amazonaws.com for EKS Pod Identity. The role can be associated with a namespace:SA pair via eks:CreatePodIdentityAssociation.
Raw rule rules/explicit/aws-eks.yaml
id: aws-eks-pod-identity-role-trusts-pods
emits: TrustsExternalIdentity
description: An IAM role whose trust policy Service principal includes pods.eks.amazonaws.com is eligible
for EKS Pod Identity associations.
match_record:
resource_type: AWS::IAM::Role
field: AssumeRolePolicyDocument
where:
- Statement[].Action includes sts:AssumeRoleWithWebIdentity
- Statement[].Principal.Service includes pods.eks.amazonaws.com
emit:
source_type: Role
source: <IAM Role>
target: <FederatedIdentity representing pods.eks.amazonaws.com>
api_source: iam:GetRole
evidence_field: AssumeRolePolicyDocument.Statement[].Principal.Service
narrative: IAM role {role.name} trusts pods.eks.amazonaws.com for EKS Pod Identity. The role can be
associated with a namespace:SA pair via eks:CreatePodIdentityAssociation.