amazon-web-servicesamazon-iamamazon-eksaws-sts

How to prevent transitive tags, which are set by EKS Pod Identity, from propagating?


When using EKS Pod Identity add-on, sessions are automatically tagged with transitive tags.

There are two issues with this:

  1. All roles transitively must have sts:TagSession in their trust policy, something that might not be feasible if not all roles are owned by the same organization.

  2. The automatic tags contain information like cluster's ARN which might not be desired to "share" with accounts down the assume role chain (through CloudTrail).

I found out that (and correct me if I'm am wrong):

  1. Transitive tags can not be ignored when assuming another role.
  2. There is no action to clear them from the current session.
  3. Transitivity propagates across accounts.
  4. There is no configuration of EKS pod identity add-on that can control if tags will be added with transitivity or not.

What other options do I have?


Solution

  • Just now, AWS added an options to disable session tags. This options is found in the "Pod Identity Association" section of the Access section of the EKS cluster.

    enter image description here