Discussion
Express Scripts
US
Last activity: 18 Jun 2024 9:38 EDT
AWS Authentication Profile without IAM Credentials
I am trying to configure AWS S3 repository. In the repository rule, as yo know, we have to provide the AWS Auth Profile. AWS Auth Profile requires AWS Access Key ID and Secret Access Key of IAM User.
Issue here is, our enterprise AWS account does not allow IAM users. Policy requires that all AWS logins must be federated thru IAM roles integrated with Okta/AD SSO.
How we can create AWS Authentication profile in Pega when Company policy does not allow creating IAM users?
One of the workaround we are tried was to get temporary access credentials (access key id and secret access key) using SAML2AWS (https://github.com/Versent/saml2aws).
Approach was to periodically refresh the Pega AWS Authentication profile with temporary credentials retrieved using SAML2AWS. However, AWS authentication is not working with temporary credentials.
Any recommendation / best practices?
Pegasystems Inc.
US
@SudheeshM8807 If you're running on EKS this can be achieved. You can create a repository using DSS instead of the Repository Rule form which allows you to skip the Authentication Profile.
Pega-Engine storage/class/<storageDestAlias>:/type aws-s3
Pega-Engine storage/class/<storageDestAlias>:/bucket <your s3 bucket name>
Pega-Engine storage/class/<storageDestAlias>:/rootpath <existing folder or prefix within s3 bucket>
The pods need to run using a service account that can use OIDC to assume an IAM role that can access the bucket. This takes a fair bit of configuration on the AWS side, you will need someone with the expertise needed to set up your cluster and IAM.
Express Scripts
US
Thanks @BrettAllen, good to know.. We are still on-prem VMs - not planning EKS move this year. Do you happen to know why the temporary STS credentials are not recognized by AWS Auth profile?
Updated: 18 Jun 2024 9:38 EDT
ING Bank
NL
@SudheeshM8807 This is exactly similar to BrettAllen's response, try if this works
1. Grant EC2 service account (which runs pega service) have the relevant IAM role to read/write the S3 bucket (mys3bucketname)
2. Create a DSS
3. Repository "myrepository" will be created
4. This repository doesn't need any authentication profile and runs on top of the EC2 service account privilege(which has relavant IAM roles for the S3 bucket which you want to access)