pod_identity_associations

Creates, updates, deletes or gets a pod_identity_association resource or lists pod_identity_associations in a region

Overview

Name	pod_identity_associations
Type	Resource
Description	An object representing an Amazon EKS PodIdentityAssociation.
Id	awscc.eks.pod_identity_associations

Fields

get (all properties)

Name	Datatype	Description
cluster_name	string	The cluster that the pod identity association is created for.
role_arn	string	The IAM role ARN that the pod identity association is created for.
namespace	string	The Kubernetes namespace that the pod identity association is created for.
service_account	string	The Kubernetes service account that the pod identity association is created for.
association_arn	string	The ARN of the pod identity association.
association_id	string	The ID of the pod identity association.
target_role_arn	string	The Target Role Arn of the pod identity association.
external_id	string	The External Id of the pod identity association.
disable_session_tags	boolean	The Disable Session Tags of the pod identity association.
▶tags	array	An array of key-value pairs to apply to this resource.
region	string	AWS region.

list (identifiers only)

Name	Datatype	Description
association_arn	string	The ARN of the pod identity association.
region	string	AWS region.

For more information, see AWS::EKS::PodIdentityAssociation.

Methods

Name	Resource	Accessible by	Required Params
create_resource	pod_identity_associations	INSERT	ClusterName, RoleArn, Namespace, ServiceAccount, region
delete_resource	pod_identity_associations	DELETE	Identifier, region
update_resource	pod_identity_associations	UPDATE	Identifier, PatchDocument, region
list_resources	pod_identity_associations_list_only	SELECT	region
get_resource	pod_identity_associations	SELECT	Identifier, region

SELECT examples

get (all properties)

Gets all properties from an individual pod_identity_association.

SELECT
  region,
  cluster_name,
  role_arn,
  namespace,
  service_account,
  association_arn,
  association_id,
  target_role_arn,
  external_id,
  disable_session_tags,
  tags
FROM awscc.eks.pod_identity_associations
WHERE
  region = 'us-east-1' AND
  Identifier = '{{ association_arn }}';

list (identifiers only)

Lists all pod_identity_associations in a region.

SELECT
  region,
  association_arn
FROM awscc.eks.pod_identity_associations_list_only
WHERE
  region = 'us-east-1';

INSERT example

Use the following StackQL query and manifest file to create a new pod_identity_association resource, using stack-deploy.

Required Properties

/*+ create */
INSERT INTO awscc.eks.pod_identity_associations (
  ClusterName,
  RoleArn,
  Namespace,
  ServiceAccount,
  region
)
SELECT
  '{{ cluster_name }}',
  '{{ role_arn }}',
  '{{ namespace }}',
  '{{ service_account }}',
  '{{ region }}';

All Properties

/*+ create */
INSERT INTO awscc.eks.pod_identity_associations (
  ClusterName,
  RoleArn,
  Namespace,
  ServiceAccount,
  TargetRoleArn,
  DisableSessionTags,
  Tags,
  region
)
SELECT
  '{{ cluster_name }}',
  '{{ role_arn }}',
  '{{ namespace }}',
  '{{ service_account }}',
  '{{ target_role_arn }}',
  '{{ disable_session_tags }}',
  '{{ tags }}',
  '{{ region }}';

Manifest

version: 1
name: stack name
description: stack description
providers:
  - aws
globals:
  - name: region
    value: '{{ vars.AWS_REGION }}'
resources:
  - name: pod_identity_association
    props:
      - name: cluster_name
        value: '{{ cluster_name }}'
      - name: role_arn
        value: '{{ role_arn }}'
      - name: namespace
        value: '{{ namespace }}'
      - name: service_account
        value: '{{ service_account }}'
      - name: target_role_arn
        value: '{{ target_role_arn }}'
      - name: disable_session_tags
        value: '{{ disable_session_tags }}'
      - name: tags
        value:
          - key: '{{ key }}'
            value: '{{ value }}'

UPDATE example

Use the following StackQL query and manifest file to update a pod_identity_association resource, using stack-deploy.

/*+ update */
UPDATE awscc.eks.pod_identity_associations
SET PatchDocument = string('{{ {
    "RoleArn": role_arn,
    "TargetRoleArn": target_role_arn,
    "DisableSessionTags": disable_session_tags,
    "Tags": tags
} | generate_patch_document }}')
WHERE
  region = '{{ region }}' AND
  Identifier = '{{ association_arn }}';

DELETE example

/*+ delete */
DELETE FROM awscc.eks.pod_identity_associations
WHERE
  Identifier = '{{ association_arn }}' AND
  region = 'us-east-1';

Permissions

To operate on the pod_identity_associations resource, the following permissions are required:

Create

eks:CreatePodIdentityAssociation,
eks:DescribePodIdentityAssociation,
eks:TagResource,
iam:PassRole,
iam:GetRole

Read

eks:DescribePodIdentityAssociation

Update

eks:DescribePodIdentityAssociation,
eks:UpdatePodIdentityAssociation,
eks:TagResource,
eks:UntagResource,
iam:PassRole,
iam:GetRole

Delete

eks:DeletePodIdentityAssociation,
eks:DescribePodIdentityAssociation

List

eks:ListPodIdentityAssociations