AWS IAM & Security Groups For Kubernetes On EKS

# Exec into problematic pod — confirm env AWS_ROLE_ARN + token file mounts exist.
kubectl -n payments exec deploy/app -- env | grep '^AWS_' || true

# STS decode with caller identity mirrors what SDK will assume.
kubectl -n payments exec deploy/app -- aws sts get-caller-identity

# Inspect ENIs tying SGs ↔ nodes — illustrative workflow; SG IDs differ per VPC.
metadata:
  nodeSelector:
    eks.amazonaws.com/nodegroup: ingress-heavy
annotations: {}
# Cross-check actual ENIs via AWS CLI / console when debugging SG egress drops.

# CloudTrail Insights / event lookup — filter iam.amazonaws.com AssumeRole.
aws logs filter-log-events \
  --log-group-name CloudTrail/Default \
  --filter-pattern "AssumeRole"

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Federated": "arn:aws:iam::ACCOUNT_ID:oidc-provider/oidc.eks.REGION.amazonaws.com/id/CLUSTER_ID"
      },
      "Action": "sts:AssumeRoleWithWebIdentity",
      "Condition": {
        "StringEquals": {
          "oidc.eks.REGION.amazonaws.com/id/CLUSTER_ID:aud": "sts.amazonaws.com",
          "oidc.eks.REGION.amazonaws.com/id/CLUSTER_ID:sub": "system:serviceaccount:payments:app-sqs-consumer"
        }
      }
    }
  ]
}

# Snapshot before edits — restores must be deterministic.
kubectl -n kube-system get configmap aws-auth -o yaml > /tmp/aws-auth-backup.yaml

apiVersion: v1
kind: ConfigMap
metadata:
  name: aws-auth
  namespace: kube-system
data:
  mapRoles: |
    - rolearn: arn:aws:iam::123456789012:role/sso-infra-platform
      username: sso-infra-{{SessionName}}
      groups:
        - system:masters  # illustrative — tighten in real environments
        - platform-crds-maintainers
    - rolearn: arn:aws:iam::123456789012:role/eks-worker-node-role
      username: system:node:{{EC2PrivateDNSName}}
      groups:
        - system:bootstrappers
        - system:nodes
    - rolearn: arn:aws:iam::123456789012:role/legacy-batch
      username: batch-role
      groups:
        - batch-readonly-ns
  mapUsers: |
    - userarn: arn:aws:iam::123456789012:user/break-glass-vault
      username: break-glass
      groups:
        - emergency-cluster-admin-temporary

# Inventory IRSA-managed roles referencing your cluster issuer.
aws iam list-roles --query 'Roles[?contains(AssumeRolePolicyDocument,`:oidc-provider/eks`)].[RoleName]' --output table

aws cloudtrail lookup-events --lookup-attributes AttributeKey=EventName,AttributeValue=AssumeRoleWithWebIdentity \
  --max-results 10

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ListPrefix",
      "Effect": "Allow",
      "Action": ["s3:ListBucket"],
      "Resource": "arn:aws:s3:::prod-artifacts",
      "Condition": {
        "StringLike": { "s3:prefix": ["releases/*"] }
      }
    },
    {
      "Sid": "ObjectRW",
      "Effect": "Allow",
      "Action": ["s3:GetObject", "s3:PutObject"],
      "Resource": "arn:aws:s3:::prod-artifacts/releases/*"
    }
  ]
}

aws ecr get-repository-policy \
  --repository-name platform/base-image \
  --region us-east-1

aws kms get-key-policy \
  --key-id alias/prod-etcd \
  --policy-name default

# Human IAM role — deterministic unit tests before widening prod privileges.
POLICY="$(cat policy-document.json)"

aws iam simulate-principal-policy \
  --policy-source-arn "$ROLE_ARN" \
  --action-names ecs:DescribeServices \
  --resource-arns "arn:aws:ecs:REGION:123456789012:service/cluster/svc"

# SCP overlay awareness — org trail account must run org-level simulation separately.
AWS_PROFILE=management-org aws organizations list-policies --filter SERVICE_CONTROL_POLICY

# Quick inline deny hunting for node autoscaler regressions — spot missing autoscaling verbs.
ACTIONS=(
  ec2:DescribeLaunchTemplateVersions
  autoscaling:SetDesiredCapacity
  autoscaling:DescribeAutoScalingGroups
  autoscaling:TerminateInstanceInAutoScalingGroup
)
for verb in "${ACTIONS[@]}"; do
  echo "checking $verb"
  aws iam simulate-principal-policy --policy-source-arn "$ROLE_ARN" \
    --action-names "$verb" || true
done

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "DenyDestructiveIamWithoutElevation",
      "Effect": "Deny",
      "Action": ["iam:*"],
      "Resource": "*",
      "Condition": {
        "StringNotEqualsIfExists": { "iam:PassedToService": "" },
        "BoolIfExists": { "aws:MultiFactorAuthPresent": "false" }
      }
    },
    {
      "Sid": "RequireApprovedPathsForNetworking",
      "Effect": "Deny",
      "Action": ["ec2:AuthorizeSecurityGroupIngress"],
      "Resource": "*",
      "Condition": {
        "ArnNotLikeIfExists": { "ec2:Vpc": "arn:aws:ec2:REGION:123456789012:vpc/enforced-training-vpc*" }
      }
    }
  ]
}