3 Tier Application On EKS
I built a 3-tier application running on Amazon EKS, deployed by a GitHub Actions pipeline that runs on every merge to main . The first version of that pipeline had two secrets sitting in the repo settings: AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY . Github- https://github.com/itzmayank01/3-tier-user-platform-devops They worked. They were also a bad idea, and getting rid of them taught me more…
The article describes the author's experience building a three-tier application on Amazon Elastic Kubernetes Service (EKS) and deploying it using GitHub Actions. The author initially used long-lived AWS access keys in the repository settings, which they later deemed a bad practice. They then switched to using short-lived JSON Web Tokens (JWT) obtained through OIDC (OpenID Connect) authentication with AWS STS (Security Token Service).
To set up this authentication flow, the author performed the following steps:
1. Registered GitHub as an identity provider in AWS IAM, creating an OpenID Connect provider that trusts GitHub's OIDC endpoint.
2. Created an IAM role with a trust policy that allows GitHub Actions to assume the role using the OIDC token. The trust policy includes conditions to ensure the token is from the correct GitHub app and branch.
3. Set up the necessary permissions for the IAM role to interact with EKS, such as describing the cluster.
4. Configured the GitHub Actions workflow to use the OIDC token for AWS authentication, specifying the role to assume and the AWS region.
5. Updated the kubeconfig using the assumed role credentials and deployed the application to the Kubernetes cluster.
The key takeaways from the article are:
- Long-lived AWS access keys are risky and should be avoided.
- OIDC authentication with AWS STS provides a more secure and short-lived authentication mechanism for CI pipelines.
- Properly configuring IAM roles and permissions is crucial for securing the deployment process.
- Using separate roles for build, push, and deploy actions can further enhance security by limiting the blast radius in case of a compromise.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.