在CDK中，如何在CDK中复制“`eksctl iamserviceaccount`”命令？

Question

我想在本指南之后设置外部机密操作符，但是在CDK中这样做。我在复制eksctl create iamserviceaccount步骤时遇到了一些困难。遵循指南创建的blogdemosa角色的信任关系如下所示：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Federated": "arn:aws:iam::<account_id>:oidc-provider/oidc.eks.us-east-1.amazonaws.com/id/<cluster_oidc_id>"
            },
            "Action": "sts:AssumeRoleWithWebIdentity",
            "Condition": {
                "StringEquals": {
                    "oidc.eks.us-east-1.amazonaws.com/id/<cluster_oidc_id>:sub": "system:serviceaccount:default:blogdemosa",
                    "oidc.eks.us-east-1.amazonaws.com/id/<cluster_oidc_id>:aud": "sts.amazonaws.com"
                }
            }
        }
    ]
}

所以我觉得我的CDK应该是这样的：

const serviceAccountRole = new iam.Role(this, 'ServiceAccountRole', {
    roleName: 'ServiceAccountRole',
    assumedBy: new iam.FederatedPrincipal(???),
    managedPolicies: [iam.ManagedPolicy.fromAwsManagedPolicyName('SecretsManagerReadWrite')]
});

const serviceAccount = cluster.addServiceAccount('ServiceAccount', {
    name: 'eso-service-account',
    annotations: {
        'eks.amazonaws.com/role-arn': serviceAccountRole.roleArn
    }
});

但是我不知道联邦校长的参数是什么。

Answer 1

我的方法是错误的，这是我所需要做的：

const serviceAccount = cluster.addServiceAccount('ServiceAccount', {
  name: 'eso-service-account',
})

serviceAccount.addToPrincipalPolicy(new iam.PolicyStatement({
  effect: iam.Effect.ALLOW,
  actions: [
    'secretsmanager:GetSecretValue',
    'secretsmanager:DescribeSecret'
  ],
  resources: [
    'arn:aws:secretsmanager:us-east-1:552593679126:secret:*'
  ]
}));