¶ AWS
To provision a Service Account for AWS with IAM integration select “IAM Service Account”:
- Make sure that you are provisioning SA into the same namespace as an application needed
- Type in the name of account (better to have it similar to the application)
- Add IAM policy (example):
policies:
- "arn:aws:iam::{ACCOUNT}:policy/some-existing-policy"
role:
policies:
LogAccess: |
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"logs:CreateLogGroup",
"logs:CreateLogStream",
"logs:PutLogEvents",
"logs:DescribeLogStreams",
"logs:PutRetentionPolicy",
"logs:FilterLogEvents",
"logs:GetLogEvents"
],
"Resource": [
"arn:aws:logs:*:*:*"
]
}
]
}
DynamoDBAccess: |
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"dynamodb:GetItem",
"dynamodb:PutItem",
"dynamodb:DeleteItem",
"dynamodb:UpdateItem",
"dynamodb:Query",
"dynamodb:Scan",
"dynamodb:DescribeStream",
"dynamodb:GetRecords",
"dynamodb:GetShardIterator",
"dynamodb:ListStreams",
"dynamodb:DescribeTable",
"dynamodb:ConditionCheckItem",
"dynamodb:CreateTable",
"dynamodb:DescribeTimeToLive",
"dynamodb:UpdateTimeToLive",
"dynamodb:BatchWriteItem",
"dynamodb:UpdateTable",
"dynamodb:BatchGetItem"
],
"Resource": [
"arn:aws:dynamodb:*:*:*"
]
}]
}
S3FullAccess: |
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"s3:*"
],
"Resource": [
"arn:aws:s3:::bucket",
"arn:aws:s3:::bucket/*"
]
},
{
"Effect": "Allow",
"Action": [
"kms:GenerateDataKey",
"kms:Encrypt",
"kms:Decrypt"
],
"Resource": "arn:aws:kms:eu-west-1:{ACCOUNT}:key/40ea1afc-a57e-4d0c-8864-ba0beb8e5456"
}
]
}
serviceAccount:
# Specifies whether a service account should be created
create: false
# Annotations to add to the service account
annotations: {}
# The name of the service account to use.
# If not set and create is true, a name is generated using the fullname template
name: "service-account-name-here"