In November 2023, AWS announced the release of a new feature to facilitate the configuration of IAM permissions for pods hosted on Amazon Elastic Kubernetes Service EKS. Prior to this announcement I had always been used to another method that I usually implement in my EKS clusters. IRSA for IAM Role for Service Accounts. The main benefit of EKS Pod Identity is the simplicity it brings to automating the management of the rights we give to applications in EKS clusters.

As I was working on a project for a client, I encountered a challenging situation. I needed to retrieve S3 objects from EC2 instances that were built from an AMI from the AWS Marketplace and deployed in private subnets with no access to the internet. The S3 service is reachable via S3 Gateway endpoints deployed in these private subnets. However, the instance did not have the AWS CLI installed, and the version of Curl that was installed did not have the option to generate Signature v4 automatically to authenticate with the AWS API (–aws-sigv4).

As part of a mission for a client, we supported the team in charge of developing data enrichment services. In this context where applications are deployed and managed by an operations team on virtual machines, the client had two main needs. To have this team adopt the DevOps methodology in order to gain agility, and to migrate to a resilient, automated architecture with the ability to scale. After a first phase during which we studied the environment and specified the client’s needs, we chose to start with an on-premise Kubernetes-based infrastructure.