I have a Jenkins master launched in eks pod with attached service account and iam role in account B.
To launch ec2 agents in account A we use ec2-plugin which configured to use iam user credentials.
account B is an external account with limited access for me.
account A is managed by me, I have admin rights.
I need to change users to iam roles for sec considerations, and I stuck with problem, because I already have an iam role attached to Jenkins master pod and I can’t change this.
- As I see, possible solution could be to use Role chaining but in this case ec2-plugin does not have functionality to assume role in section: Configure (Amazon EC2 Credentials).
- Second possibility is to use Cross-account access with [identity,resource]-based policies but I don’t have enough understanding of this concept and I read on the next page Services that work with IAM that ec2 doesn’t support Resource-based policies. However, due to my limited knowledge on this topic, I may overlook something at this moment.
- Third solution is to change plugin to plugin with the similar functionality and possibility to make assume role step.
Question: Can someone suggest solution in current situation?