Usage on EKS with ServiceAccount

[RobinFrcd]

Hi,
I'm currently using the package with this config on ECS, and it works fine, it gets the role associated to the ECS task.

config :ex_aws,
  access_key_id: [{:system, "AWS_ACCESS_KEY_ID"}, :instance_role],
  secret_access_key: [{:system, "AWS_SECRET_ACCESS_KEY"}, :instance_role],
  region: [{:system, "AWS_REGION"}, :instance_role],

I recently tried to deploy my service on EKS, but instead of using the profile provided by the ServiceAccount, it uses the profile of the node.

Is there any way to configure ex_aws to make it use the ServiceAccount role but still work with ECS ?

Thanks,
Robin

[bernardd]

As luck would have it I was just playing around with this the other day. In theory you should be able to do it using the role-based authentication system described in Using Web Idenity tokens from ENV vars. I unfortunately hit some unrelated problems and had to move on to other stuff, but the docs certainly suggest it should work with the AWS_WEB_IDENTITY_TOKEN_FILE env var being set correctly (and the config being set as described in those docs). I'd be very interested in hearing how you get on with it.