Skip to Content
IntegrationsCloud Marketplace IntegrationAWSWorkload Identity Setup

Workload Identity Setup

AWS IAM Roles for Service Accounts (IRSA) allows your ScaleOps pods to securely access AWS resources without storing IAM credentials in your cluster.

Prerequisites

  • EKS cluster with OIDC identity provider enabled
  • AWS CLI installed and configured
  • kubectl access to your EKS cluster

Step 1: Create IAM Policy

First, create the IAM policy for marketplace integration permissions:

# Create the IAM policy
aws iam create-policy \
  --policy-name scaleops-marketplace-integration-access-policy \
  --policy-document '{
    "Version": "2012-10-17",
    "Statement": [
      {
        "Sid": "SimulateIAM",
        "Effect": "Allow",
        "Action": [
          "iam:SimulatePrincipalPolicy"
        ],
        "Resource": "*"
      },
      {
        "Sid": "MarketplaceTagging",
        "Effect": "Allow",
        "Action": [
          "ec2:CreateTags"
        ],
        "Resource": "arn:aws:ec2:*:*:volume/*"
      }
    ]
  }' > /dev/null

Step 2: Create IAM Role for Each EKS Cluster

For each EKS cluster that needs the marketplace integration, create a separate IAM role with the appropriate trust policy.

Note: The trust policy subjects below use scaleops-system, which is the namespace where ScaleOps is installed by default. If you installed ScaleOps into a different namespace, set SCALEOPS_NAMESPACE accordingly.

# Get your EKS cluster OIDC issuer URL
CLUSTER_ISSUER=$(aws eks describe-cluster --name <CLUSTER_NAME> --region <REGION> --query "cluster.identity.oidc.issuer" --output text | sed -e "s/^https:\/\///")
 
# Get your AWS account ID
ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)
 
# The namespace where ScaleOps is installed (scaleops-system by default)
SCALEOPS_NAMESPACE="scaleops-system"
 
# Create the IAM role
ROLE_NAME="scaleops-marketplace-integration-workload-identity-role"
 
aws iam create-role \
  --role-name $ROLE_NAME \
  --assume-role-policy-document "{
    \"Version\": \"2012-10-17\",
    \"Statement\": [
      {
        \"Effect\": \"Allow\",
        \"Principal\": {
          \"Federated\": \"arn:aws:iam::${ACCOUNT_ID}:oidc-provider/${CLUSTER_ISSUER}\"
        },
        \"Action\": \"sts:AssumeRoleWithWebIdentity\",
        \"Condition\": {
          \"StringEquals\": {
            \"${CLUSTER_ISSUER}:sub\": [
              \"system:serviceaccount:${SCALEOPS_NAMESPACE}:scaleops-agent\",
              \"system:serviceaccount:${SCALEOPS_NAMESPACE}:scaleops-dashboards\",
              \"system:serviceaccount:${SCALEOPS_NAMESPACE}:scaleops-recommender\",
              \"system:serviceaccount:${SCALEOPS_NAMESPACE}:scaleops-updater\"
            ],
            \"${CLUSTER_ISSUER}:aud\": \"sts.amazonaws.com\"
          }
        }
      }
    ]
  }" > /dev/null
 
# Attach the policy to the role
aws iam attach-role-policy \
  --role-name $ROLE_NAME \
  --policy-arn arn:aws:iam::$ACCOUNT_ID:policy/scaleops-marketplace-integration-access-policy > /dev/null

Step 3: Configure ScaleOps Helm Values

Grab the role ARN from the output of the above command.

ROLE_NAME="scaleops-marketplace-integration-workload-identity-role"
aws iam get-role --role-name $ROLE_NAME --query "Role.Arn" --output text

For each cluster, configure the Helm values to use workload identity:

global:
  serviceAccount:
    annotations:
      eks.amazonaws.com/role-arn: "<ROLE_ARN>"
 
cloudMarketplaceIntegration:
  aws:
    enabled: true
Terraform SetupArchitecture