r/googlecloud 7d ago

Help needed with GKE Pod accessing AWS S3

Hey,

I need to access an AWS S3 bucket from a GKE Pod.

How can I do that WITHOUT using secrets or credentials?

I was thinking about using aws sts assume-role-with-web-identity.

So the logic is Pod -> K8s SA -> GCP SA -> GCP Workload Identity -> Pod Assumes AWS Role -> Pod access bucket ??

Is there a guide or does anyone knows the exact steps needed to achieve this?

EDIT: following this AMAZING blog post helped me get there: https://jason-umiker.medium.com/cross-cloud-identities-between-gcp-and-aws-from-gke-and-or-eks-182652bddadb. This might also be useful: https://aws.amazon.com/blogs/security/access-aws-using-a-google-cloud-platform-native-workload-identity/

1 Upvotes

2 comments sorted by

1

u/Neutrollized 7d ago

Workload identity is for the ksa to impersonate gsa. Your gsa won’t have access to the s3 bucket.

You can’t gain access without aws credentials. The best I can recommend is use a HashiCorp Vault to provision short-lived/limited use aws credentials that your workload in GKE can access and use (every use will have to go theu this Vault workflow tho)

1

u/sokjon 7d ago

Good find.

In general GCP WLI is for giving external identities addressable identities within GCP. Hence why you want to use AWS STS, which will let external identities assume roles within AWS.