We have several on-premises Kubernetes clusters that need to utilize AWS services. Currently, we use traditional IAM Users with static credentials, but we recognize this is a bad practice. We want to transition to using temporary credentials but are struggling to find the optimal solution.

Here are the approaches we've considered and their challenges:

Vault with AWS Engines: This provides credentials, but the clusters need a key for Vault, which substitutes one long-term credential for another.

IAM Roles Anywhere: We're unsure how to properly store certificates and set up AWS Profiles so that different pods can use them. Additionally, the certificate feels like another form of long-term credential.

We are looking for a more secure and manageable solution. Does EKS Anywhere solve our problem, or is there another recommended approach for managing temporary AWS credentials in on-premises Kubernetes clusters?

Any advice or guides would be greatly appreciated. Thank you!

  • Have you considered using something like HashiCorp Vault? Commented Jul 9 at 16:30
  • We have, as I wrote it's one of the solutions we tried but we didn't see the added value of using a Vault token instead of IAM credentials. Unless you know of another method to authenticate with Vault in K8s that works well and is properly documented. Commented Jul 10 at 17:24
  • Ah I see, I was unsure what you meant by that hence the question. Not my field of expertise, but I would automate as much as possible tbh (if without loss of security etc.) Commented Jul 11 at 15:27


You must log in to answer this question.

Browse other questions tagged .