How Pod Identity Webhook Controls Per-Pod IAM Permissions on EKS

Devsisters adopted the Pod Identity Webhook add-on for fine-grained, pod-level IAM permission control in its AWS EKS environment. Existing solutions like kube2iam and kiam worked by intercepting the instance metadata API to perform Assume Role, but Pod Identity Webhook, which is EKS-specific, operates by injecting the necessary settings into the pod spec via an admission controller.

How Pod Identity Webhook Works

Pod Identity Webhook uses mutating webhook functionality to automatically inject the following three settings when a pod is created.

• Environment variables: AWS_ROLE_ARN (the role ARN to use) and AWS_WEB_IDENTITY_TOKEN_FILE (the token path)
• Volume mount: mounts the service account token at the path /var/run/secrets/eks.amazonaws.com/serviceaccount
• Projected volume: uses projectedServiceAccountToken with audience set to sts.amazonaws.com

This token is verified via the EKS IdP (OpenID Connect Provider), and the AWS SDK uses it to call AssumeRoleWithWebIdentity to obtain temporary credentials. Through this process, the pod does not share the instance's IAM role and instead uses only the permissions of the designated IAM role.

Configuration and Cautions

To use Pod Identity Webhook, an EKS cluster running Kubernetes 1.14 or higher is required, and the Docker image must be built directly from the official GitHub repository. During installation, resources can be created via the make cluster-up command, but if the certificate signing request (CSR) is in a Pending state, manual approval is required using the kubectl certificate approve command.

Additionally, to allow a pod to Assume a specific IAM role, the EKS IdP must be registered as an Identity Provider in AWS IAM, and sts:AssumeRoleWithWebIdentity permission must be added to the Trust Relationship of that role. When using Terraform, there is a constraint that the thumbprint_list field must be entered manually. Devsisters strengthened security and reduced dependency on external add-ons through this approach.