IAM

IAMRole # ✅ Working

Creates and manages IAM roles including trust policies, permissions boundaries, path, max session duration, and tags. Includes drift detection on the trust policy document.

Spec

Status

Example

apiVersion: aws.konfig.io/v1alpha1
kind: IAMRole
metadata:
  name: my-app-role
  namespace: my-namespace
spec:
  roleName: my-app-role
  description: "Role for my application"
  maxSessionDuration: 3600
  assumeRolePolicyDocument: |
    {
      "Version": "2012-10-17",
      "Statement": [{
        "Effect": "Allow",
        "Principal": { "Service": "pods.eks.amazonaws.com" },
        "Action": ["sts:AssumeRole", "sts:TagSession"]
      }]
    }
  tags:
    team: platform
    env: prod

Notes

• roleName is immutable after creation. To rename a role, delete the CR and recreate it.
• Drift detection runs on the trust policy document on every reconcile cycle.
• By default, the operator is configured to only manage IAM roles under the /konfig/ path. This restriction can be adjusted in the operator's Helm values.
• For EKS Pod Identity, the trust policy must allow pods.eks.amazonaws.com as the principal with actions sts:AssumeRole and sts:TagSession.

Deletion

IAMPolicy # ✅ Working

Manages customer-managed IAM policies. Policy document changes create new versions; non-default versions beyond the 5-version limit are automatically deleted.

Spec

Status

Example

apiVersion: aws.konfig.io/v1alpha1
kind: IAMPolicy
metadata:
  name: my-app-policy
  namespace: my-namespace
spec:
  policyName: my-app-policy
  description: "Grants S3 read access to my application"
  policyDocument: |
    {
      "Version": "2012-10-17",
      "Statement": [{
        "Effect": "Allow",
        "Action": ["s3:GetObject", "s3:ListBucket"],
        "Resource": [
          "arn:aws:s3:::my-bucket",
          "arn:aws:s3:::my-bucket/*"
        ]
      }]
    }
  tags:
    team: platform

Notes

• Changes to policyDocument create a new version using CreatePolicyVersion with setAsDefault: true.
• IAM allows a maximum of 5 non-deleted versions per policy. Older non-default versions are automatically deleted when the limit is reached.
• For attaching AWS managed policies (e.g. arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess), use IAMPolicyAttachment with a direct ARN — you do not need to create an IAMPolicy CR for managed policies.

Deletion

IAMPolicyAttachment # ✅ Working

Attaches a managed IAM policy to an IAM role. Supports referencing other CRs by name or using direct ARNs for AWS managed policies.

Spec

Status

Example — CR Reference

apiVersion: aws.konfig.io/v1alpha1
kind: IAMPolicyAttachment
metadata:
  name: my-app-role-policy
  namespace: my-namespace
spec:
  roleRef:
    name: my-app-role    # references IAMRole CR
  policyRef:
    name: my-app-policy  # references IAMPolicy CR

Example — AWS Managed Policy

apiVersion: aws.konfig.io/v1alpha1
kind: IAMPolicyAttachment
metadata:
  name: my-app-role-s3-readonly
  namespace: my-namespace
spec:
  roleRef:
    name: my-app-role
  policyRef:
    arn: arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess

Notes

• The controller waits for both the role CR and policy CR to be Ready before attempting the attachment.
• The attachment is verified on every reconcile cycle; if it has been manually removed from AWS, the controller re-attaches it.
• Exactly one of roleRef.name or roleRef.arn must be specified; same applies to policyRef.

Deletion

IAMRolePolicy # ✅ Working

Embeds an inline policy directly on an IAM role. Inline policies are tightly coupled to the role and do not have their own ARN or version history.

Spec

Status

Example

apiVersion: aws.konfig.io/v1alpha1
kind: IAMRolePolicy
metadata:
  name: my-app-inline-policy
  namespace: my-namespace
spec:
  roleRef:
    name: my-app-role
  policyName: AllowDynamoDBAccess
  policyDocument: |
    {
      "Version": "2012-10-17",
      "Statement": [{
        "Effect": "Allow",
        "Action": ["dynamodb:GetItem", "dynamodb:PutItem", "dynamodb:Query"],
        "Resource": "arn:aws:dynamodb:us-east-1:123456789012:table/my-table"
      }]
    }

Notes

• Prefer IAMPolicy + IAMPolicyAttachment for policies shared across multiple roles.
• Drift correction is always active — if the inline policy is removed or changed in AWS, the controller re-applies it.
• Inline policies do not count toward the IAM policy version limit.

Deletion

PodIdentityAssociation # ✅ Working

Links a Kubernetes ServiceAccount to an IAM role via EKS Pod Identity. Optionally annotates the ServiceAccount with the role ARN for compatibility.

Spec

Status

Example

apiVersion: aws.konfig.io/v1alpha1
kind: IAMRole
metadata:
  name: my-app-role
  namespace: platform
spec:
  roleName: my-app-role
  assumeRolePolicyDocument: |
    {
      "Version": "2012-10-17",
      "Statement": [{
        "Effect": "Allow",
        "Principal": { "Service": "pods.eks.amazonaws.com" },
        "Action": ["sts:AssumeRole", "sts:TagSession"]
      }]
    }
---
apiVersion: aws.konfig.io/v1alpha1
kind: PodIdentityAssociation
metadata:
  name: my-app-pod-identity
  namespace: platform
spec:
  clusterName: my-eks-cluster
  targetNamespace: my-app
  serviceAccountName: my-app-sa
  roleRef:
    name: my-app-role
  annotateServiceAccount: true
  tags:
    team: platform

Notes

• Requires the eks-pod-identity-agent addon to be installed on the cluster. See EKSAddon.
• Only one association is allowed per (cluster, namespace, serviceAccountName) triple. Creating a second one will fail.
• The IAM role trust policy must allow pods.eks.amazonaws.com as the principal with both sts:AssumeRole and sts:TagSession actions.
• The clusterName here refers to the AWS EKS cluster name, not a CR reference.

Deletion

IAMUser # ✅ Working

Manages IAM users with path, permissions boundary, and tag sync. Does not manage access keys — create access keys through the AWS console or CLI.

Spec

Status

Example

apiVersion: aws.konfig.io/v1alpha1
kind: IAMUser
metadata:
  name: ci-deploy-user
  namespace: platform
spec:
  userName: ci-deploy-user
  path: /automation/
  tags:
    purpose: ci-cd
    team: platform

Notes

• userName is immutable after creation.
• Access key management is intentionally out of scope. Use the AWS console, CLI, or a separate automation to create and rotate access keys.
• Use IAMGroupMembership to add the user to groups, and IAMPolicyAttachment / IAMGroupPolicyAttachment to attach policies.

Deletion

IAMGroup # ✅ Working

Creates an IAM group. Group membership and policy attachments are managed via IAMGroupMembership and IAMGroupPolicyAttachment CRs.

Spec

Status

Example

apiVersion: aws.konfig.io/v1alpha1
kind: IAMGroup
metadata:
  name: developers-group
  namespace: platform
spec:
  groupName: developers
  path: /teams/

Notes

• groupName is immutable after creation.
• Add users to the group with IAMGroupMembership CRs; attach policies with IAMGroupPolicyAttachment CRs.

Deletion

IAMGroupPolicyAttachment # ✅ Working

Attaches a managed IAM policy to an IAM group. Supports CR references or direct names/ARNs.

Spec

Status

Example

apiVersion: aws.konfig.io/v1alpha1
kind: IAMGroupPolicyAttachment
metadata:
  name: developers-s3-policy
  namespace: platform
spec:
  groupRef:
    name: developers-group
  policyRef:
    arn: arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess

Deletion

IAMGroupMembership # ✅ Working

Adds an IAM user to an IAM group. One CR per user-group relationship.

Spec

Status

Example

apiVersion: aws.konfig.io/v1alpha1
kind: IAMGroupMembership
metadata:
  name: alice-developers
  namespace: platform
spec:
  groupRef:
    name: developers-group
  userRef:
    name: alice-user

Deletion

IAMSAMLProvider # ✅ Working

Creates a SAML identity provider in IAM for federated authentication. The provider name is immutable and forms part of the ARN.

Spec

Status

Example

apiVersion: aws.konfig.io/v1alpha1
kind: IAMSAMLProvider
metadata:
  name: my-saml-idp
  namespace: platform
spec:
  name: MyCorpIdP
  samlMetadataDocument: |
    <?xml version="1.0"?>
    <EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata" ...>
      <!-- SAML metadata from your IdP -->
    </EntityDescriptor>
  tags:
    idp: okta

Notes

• spec.name is immutable after creation — it forms part of the ARN. To rename, delete and recreate.
• Metadata document changes are applied via UpdateSAMLProvider with drift detection on every reconcile.

Deletion

IAMOIDCProvider # ✅ Working

Creates an OpenID Connect (OIDC) identity provider in IAM for workload identity federation. The URL is immutable; thumbprints and client IDs are mutable with delta sync.

Spec

Status

Example

apiVersion: aws.konfig.io/v1alpha1
kind: IAMOIDCProvider
metadata:
  name: my-eks-oidc
  namespace: platform
spec:
  url: https://oidc.eks.us-east-1.amazonaws.com/id/EXAMPLED539D4633E53DE1B716D3041E
  clientIDList:
    - sts.amazonaws.com
  thumbprintList:
    - 9e99a48a9960b14926bb7f3b02e22da2b0ab7280
  tags:
    cluster: my-eks-cluster

Notes

• url is immutable after creation. The URL is extracted to form the provider ARN.
• thumbprintList and clientIDList support delta sync — the controller adds new entries and removes entries no longer in spec.
• For EKS clusters, the OIDC issuer URL is available in the cluster's status after provisioning. See EKSCluster.

Deletion