Amazon EKS Eks Pod Identity Associations API

openapi: 3.1.0
info:
  title: Amazon Elastic Kubernetes Service Pod Identity Associations API
  version: '2017-11-01'
  description: Generated from AWS's published Smithy model for Amazon Elastic Kubernetes Service. 5 operation(s).
  contact:
    name: Amazon Web Services
    url: https://aws.amazon.com/contact-us/
  license:
    name: Apache 2.0
    identifier: Apache-2.0
    url: https://github.com/aws/api-models-aws/blob/main/LICENSE
servers:
- url: https://eks.{region}.amazonaws.com
  variables:
    region:
      default: us-east-1
security:
- sigv4: []
paths:
  /clusters/{clusterName}/pod-identity-associations:
    post:
      operationId: CreatePodIdentityAssociation
      summary: Create Pod Identity Association
      description: Creates an EKS Pod Identity association between a service account in an Amazon EKS cluster and an IAM role
        with EKS Pod Identity. Use EKS Pod Identity to give temporary IAM credentials to Pods and the credentials are rotated
        automatically. Amazon EKS Pod Identity associations provide the ability to manage credentials for your applications,
        similar to the way that Amazon EC2 instance profiles provide credentials to Amazon EC2 instances. If a Pod uses a
        service account that has an association, Amazon EKS sets environment variables in the containers of the Pod. The environment
        variables configure the Amazon Web Services SDKs, including the Command Line Interface, to use the EKS Pod Identity
        credentials. EKS Pod Identity is a simpler method than IAM roles for service accounts, as this method doesn't use
        OIDC identity providers. Additionally, you can configure a role for EKS Pod Identity once, and reuse it across clusters.
        Similar to Amazon Web Services IAM behavior, EKS Pod Identity associations are eventually consistent, and may take
        several seconds to be effective after the initial API call returns successfully. You must design your applications
        to account for these potential delays.
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CreatePodIdentityAssociationResponse'
        '400':
          description: InvalidParameterException; InvalidRequestException; ResourceLimitExceededException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InvalidParameterException'
        '409':
          description: ResourceInUseException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ResourceInUseException'
        '404':
          description: ResourceNotFoundException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ResourceNotFoundException'
        '500':
          description: ServerException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ServerException'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreatePodIdentityAssociationRequest'
      tags:
      - Pod Identity Associations
    get:
      operationId: ListPodIdentityAssociations
      summary: List Pod Identity Associations
      description: List the EKS Pod Identity associations in a cluster. You can filter the list by the namespace that the
        association is in or the service account that the association uses.
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListPodIdentityAssociationsResponse'
        '400':
          description: InvalidParameterException; InvalidRequestException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InvalidParameterException'
        '404':
          description: ResourceNotFoundException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ResourceNotFoundException'
        '500':
          description: ServerException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ServerException'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ListPodIdentityAssociationsRequest'
      tags:
      - Pod Identity Associations
  /clusters/{clusterName}/pod-identity-associations/{associationId}:
    delete:
      operationId: DeletePodIdentityAssociation
      summary: Delete Pod Identity Association
      description: Deletes a EKS Pod Identity association. The temporary Amazon Web Services credentials from the previous
        IAM role session might still be valid until the session expiry. If you need to immediately revoke the temporary session
        credentials, then go to the role in the IAM console.
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DeletePodIdentityAssociationResponse'
        '400':
          description: InvalidParameterException; InvalidRequestException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InvalidParameterException'
        '404':
          description: ResourceNotFoundException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ResourceNotFoundException'
        '500':
          description: ServerException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ServerException'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/DeletePodIdentityAssociationRequest'
      tags:
      - Pod Identity Associations
    get:
      operationId: DescribePodIdentityAssociation
      summary: Describe Pod Identity Association
      description: Returns descriptive information about an EKS Pod Identity association. This action requires the ID of the
        association. You can get the ID from the response to the CreatePodIdentityAssocation for newly created associations.
        Or, you can list the IDs for associations with ListPodIdentityAssociations and filter the list by namespace or service
        account.
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DescribePodIdentityAssociationResponse'
        '400':
          description: InvalidParameterException; InvalidRequestException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InvalidParameterException'
        '404':
          description: ResourceNotFoundException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ResourceNotFoundException'
        '500':
          description: ServerException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ServerException'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/DescribePodIdentityAssociationRequest'
      tags:
      - Pod Identity Associations
    post:
      operationId: UpdatePodIdentityAssociation
      summary: Update Pod Identity Association
      description: 'Updates a EKS Pod Identity association. In an update, you can change the IAM role, the target IAM role,
        or disableSessionTags. You must change at least one of these in an update. An association can''t be moved between
        clusters, namespaces, or service accounts. If you need to edit the namespace or service account, you need to delete
        the association and then create a new association with your desired settings. Similar to Amazon Web Services IAM behavior,
        EKS Pod Identity associations are eventually consistent, and may take several seconds to be effective after the initial
        API call returns successfully. You must design your applications to account for these potential delays. We recommend
        that you don’t include association create/updates in the critical, high-availability code paths of your application.
        Instead, make changes in a separate initialization or setup routine that you run less frequently. You can set a target
        IAM role in the same or a different account for advanced scenarios. With a target role, EKS Pod Identity automatically
        performs two role assumptions in sequence: first assuming the role in the association that is in this account, then
        using those credentials to assume th'
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UpdatePodIdentityAssociationResponse'
        '400':
          description: InvalidParameterException; InvalidRequestException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InvalidParameterException'
        '404':
          description: ResourceNotFoundException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ResourceNotFoundException'
        '500':
          description: ServerException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ServerException'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdatePodIdentityAssociationRequest'
      tags:
      - Pod Identity Associations
components:
  securitySchemes:
    sigv4:
      type: apiKey
      in: header
      name: Authorization
      description: AWS Signature Version 4. The Authorization header carries an AWS4-HMAC-SHA256 signature over the canonical
        request, with X-Amz-Date (and X-Amz-Security-Token for temporary credentials). Not a bearer token.
      x-aws-sigv4:
        signingName: eks
  schemas:
    CreatePodIdentityAssociationRequest:
      type: object
      properties:
        clusterName:
          type: string
          description: The name of the cluster to create the EKS Pod Identity association in.
        namespace:
          type: string
          description: The name of the Kubernetes namespace inside the cluster to create the EKS Pod Identity association
            in. The service account and the Pods that use the service account must be in this namespace.
        serviceAccount:
          type: string
          description: The name of the Kubernetes service account inside the cluster to associate the IAM credentials with.
        roleArn:
          type: string
          description: The Amazon Resource Name (ARN) of the IAM role to associate with the service account. The EKS Pod Identity
            agent manages credentials to assume this role for applications in the containers in the Pods that use this service
            account.
        clientRequestToken:
          type: string
          description: A unique, case-sensitive identifier that you provide to ensure the idempotency of the request.
        tags:
          type: object
          additionalProperties:
            type: string
          description: 'Metadata that assists with categorization and organization. Each tag consists of a key and an optional
            value. You define both. Tags don''t propagate to any other cluster or Amazon Web Services resources. The following
            basic restrictions apply to tags: Maximum number of tags per resource – 50 For each resource, each tag key must
            be unique, and each tag key can have only one value. Maximum key length – 128 Unicode characters in UTF-8 Maximum
            value length – 256 Unicode characters in UTF-8 If your tagging schema is used across multiple services and resources,
            remember that other services may have r'
        disableSessionTags:
          type: boolean
          description: Disable the automatic sessions tags that are appended by EKS Pod Identity. EKS Pod Identity adds a
            pre-defined set of session tags when it assumes the role. You can use these tags to author a single role that
            can work across resources by allowing access to Amazon Web Services resources based on matching tags. By default,
            EKS Pod Identity attaches six tags, including tags for cluster name, namespace, and service account name. For
            the list of tags added by EKS Pod Identity, see List of session tags added by EKS Pod Identity in the Amazon EKS
            User Guide. Amazon Web Services compresses inline sess
        targetRoleArn:
          type: string
          description: The Amazon Resource Name (ARN) of the target IAM role to associate with the service account. This role
            is assumed by using the EKS Pod Identity association role, then the credentials for this role are injected into
            the Pod. When you run applications on Amazon EKS, your application might need to access Amazon Web Services resources
            from a different role that exists in the same or different Amazon Web Services account. For example, your application
            running in “Account A” might need to access resources, such as Amazon S3 buckets in “Account B” or within “Account
            A” itself. You can create a associ
        policy:
          type: string
          description: 'An optional IAM policy in JSON format (as an escaped string) that applies additional restrictions
            to this pod identity association beyond the IAM policies attached to the IAM role. This policy is applied as the
            intersection of the role''s policies and this policy, allowing you to reduce the permissions that applications
            in the pods can use. Use this policy to enforce least privilege access while still leveraging a shared IAM role
            across multiple applications. Important considerations Session tags: When using this policy, disableSessionTags
            must be set to true. Target role permissions: If you sp'
      required:
      - clusterName
      - namespace
      - serviceAccount
      - roleArn
    CreatePodIdentityAssociationResponse:
      type: object
      properties:
        association:
          $ref: '#/components/schemas/PodIdentityAssociation'
    DeletePodIdentityAssociationRequest:
      type: object
      properties:
        clusterName:
          type: string
          description: The cluster name that
        associationId:
          type: string
          description: The ID of the association to be deleted.
      required:
      - clusterName
      - associationId
    DeletePodIdentityAssociationResponse:
      type: object
      properties:
        association:
          $ref: '#/components/schemas/PodIdentityAssociation'
    DescribePodIdentityAssociationRequest:
      type: object
      properties:
        clusterName:
          type: string
          description: The name of the cluster that the association is in.
        associationId:
          type: string
          description: The ID of the association that you want the description of.
      required:
      - clusterName
      - associationId
    DescribePodIdentityAssociationResponse:
      type: object
      properties:
        association:
          $ref: '#/components/schemas/PodIdentityAssociation'
    InvalidParameterException:
      type: object
      properties:
        clusterName:
          type: string
          description: The Amazon EKS cluster associated with the exception.
        nodegroupName:
          type: string
          description: The Amazon EKS managed node group associated with the exception.
        fargateProfileName:
          type: string
          description: The Fargate profile associated with the exception.
        addonName:
          type: string
          description: The specified parameter for the add-on name is invalid. Review the available parameters for the API
            request
        subscriptionId:
          type: string
          description: The Amazon EKS subscription ID with the exception.
        message:
          type: string
          description: The specified parameter is invalid. Review the available parameters for the API request.
    ListPodIdentityAssociationsRequest:
      type: object
      properties:
        clusterName:
          type: string
          description: The name of the cluster that the associations are in.
        namespace:
          type: string
          description: The name of the Kubernetes namespace inside the cluster that the associations are in.
        serviceAccount:
          type: string
          description: The name of the Kubernetes service account that the associations use.
        maxResults:
          type: integer
          description: The maximum number of EKS Pod Identity association results returned by ListPodIdentityAssociations
            in paginated output. When you use this parameter, ListPodIdentityAssociations returns only maxResults results
            in a single page along with a nextToken response element. You can see the remaining results of the initial request
            by sending another ListPodIdentityAssociations request with the returned nextToken value. This value can be between
            1 and 100. If you don't use this parameter, ListPodIdentityAssociations returns up to 100 results and a nextToken
            value if applicable.
        nextToken:
          type: string
          description: The nextToken value returned from a previous paginated ListUpdates request where maxResults was used
            and the results exceeded the value of that parameter. Pagination continues from the end of the previous results
            that returned the nextToken value. This token should be treated as an opaque identifier that is used only to retrieve
            the next items in a list and not for other programmatic purposes.
      required:
      - clusterName
    ListPodIdentityAssociationsResponse:
      type: object
      properties:
        associations:
          type: array
          items:
            $ref: '#/components/schemas/PodIdentityAssociationSummary'
          description: 'The list of summarized descriptions of the associations that are in the cluster and match any filters
            that you provided. Each summary is simplified by removing these fields compared to the full PodIdentityAssociation
            : The IAM role: roleArn The timestamp that the association was created at: createdAt The most recent timestamp
            that the association was modified at:. modifiedAt The tags on the association: tags'
        nextToken:
          type: string
          description: The nextToken value to include in a future ListPodIdentityAssociations request. When the results of
            a ListPodIdentityAssociations request exceed maxResults, you can use this value to retrieve the next page of results.
            This value is null when there are no more results to return. This token should be treated as an opaque identifier
            that is used only to retrieve the next items in a list and not for other programmatic purposes.
    PodIdentityAssociation:
      type: object
      properties:
        clusterName:
          type: string
          description: The name of the cluster that the association is in.
        namespace:
          type: string
          description: The name of the Kubernetes namespace inside the cluster to create the association in. The service account
            and the Pods that use the service account must be in this namespace.
        serviceAccount:
          type: string
          description: The name of the Kubernetes service account inside the cluster to associate the IAM credentials with.
        roleArn:
          type: string
          description: The Amazon Resource Name (ARN) of the IAM role to associate with the service account. The EKS Pod Identity
            agent manages credentials to assume this role for applications in the containers in the Pods that use this service
            account.
        associationArn:
          type: string
          description: The Amazon Resource Name (ARN) of the association.
        associationId:
          type: string
          description: The ID of the association.
        tags:
          type: object
          additionalProperties:
            type: string
          description: 'Metadata that assists with categorization and organization. Each tag consists of a key and an optional
            value. You define both. Tags don''t propagate to any other cluster or Amazon Web Services resources. The following
            basic restrictions apply to tags: Maximum number of tags per resource – 50 For each resource, each tag key must
            be unique, and each tag key can have only one value. Maximum key length – 128 Unicode characters in UTF-8 Maximum
            value length – 256 Unicode characters in UTF-8 If your tagging schema is used across multiple services and resources,
            remember that other services may have r'
        createdAt:
          type: string
          format: date-time
          description: The timestamp that the association was created at.
        modifiedAt:
          type: string
          format: date-time
          description: The most recent timestamp that the association was modified at.
        ownerArn:
          type: string
          description: If defined, the EKS Pod Identity association is owned by an Amazon EKS add-on.
        disableSessionTags:
          type: boolean
          description: The state of the automatic sessions tags. The value of true disables these tags. EKS Pod Identity adds
            a pre-defined set of session tags when it assumes the role. You can use these tags to author a single role that
            can work across resources by allowing access to Amazon Web Services resources based on matching tags. By default,
            EKS Pod Identity attaches six tags, including tags for cluster name, namespace, and service account name. For
            the list of tags added by EKS Pod Identity, see List of session tags added by EKS Pod Identity in the Amazon EKS
            User Guide.
        targetRoleArn:
          type: string
          description: The Amazon Resource Name (ARN) of the target IAM role to associate with the service account. This role
            is assumed by using the EKS Pod Identity association role, then the credentials for this role are injected into
            the Pod.
        externalId:
          type: string
          description: The unique identifier for this EKS Pod Identity association for a target IAM role. You put this value
            in the trust policy of the target role, in a Condition to match the sts.ExternalId. This ensures that the target
            role can only be assumed by this association. This prevents the confused deputy problem. For more information
            about the confused deputy problem, see The confused deputy problem in the IAM User Guide. If you want to use the
            same target role with multiple associations or other roles, use independent statements in the trust policy to
            allow sts:AssumeRole access from each role.
        policy:
          type: string
          description: An optional IAM policy in JSON format (as an escaped string) that applies additional restrictions to
            this pod identity association beyond the IAM policies attached to the IAM role. This policy is applied as the
            intersection of the role's policies and this policy, allowing you to reduce the permissions that applications
            in the pods can use. Use this policy to enforce least privilege access while still leveraging a shared IAM role
            across multiple applications.
    PodIdentityAssociationSummary:
      type: object
      properties:
        clusterName:
          type: string
          description: The name of the cluster that the association is in.
        namespace:
          type: string
          description: The name of the Kubernetes namespace inside the cluster to create the association in. The service account
            and the Pods that use the service account must be in this namespace.
        serviceAccount:
          type: string
          description: The name of the Kubernetes service account inside the cluster to associate the IAM credentials with.
        associationArn:
          type: string
          description: The Amazon Resource Name (ARN) of the association.
        associationId:
          type: string
          description: The ID of the association.
        ownerArn:
          type: string
          description: If defined, the association is owned by an Amazon EKS add-on.
    ResourceInUseException:
      type: object
      properties:
        clusterName:
          type: string
          description: The Amazon EKS cluster associated with the exception.
        nodegroupName:
          type: string
          description: The Amazon EKS managed node group associated with the exception.
        addonName:
          type: string
          description: The specified add-on name is in use.
        message:
          type: string
          description: The Amazon EKS message associated with the exception.
    ResourceNotFoundException:
      type: object
      properties:
        clusterName:
          type: string
          description: The Amazon EKS cluster associated with the exception.
        nodegroupName:
          type: string
          description: The Amazon EKS managed node group associated with the exception.
        fargateProfileName:
          type: string
          description: The Fargate profile associated with the exception.
        addonName:
          type: string
          description: The Amazon EKS add-on name associated with the exception.
        subscriptionId:
          type: string
          description: The Amazon EKS subscription ID with the exception.
        message:
          type: string
          description: The Amazon EKS message associated with the exception.
    ServerException:
      type: object
      properties:
        clusterName:
          type: string
          description: The Amazon EKS cluster associated with the exception.
        nodegroupName:
          type: string
          description: The Amazon EKS managed node group associated with the exception.
        addonName:
          type: string
          description: The Amazon EKS add-on name associated with the exception.
        subscriptionId:
          type: string
          description: The Amazon EKS subscription ID with the exception.
        message:
          type: string
          description: These errors are usually caused by a server-side issue.
    UpdatePodIdentityAssociationRequest:
      type: object
      properties:
        clusterName:
          type: string
          description: The name of the cluster that you want to update the association in.
        associationId:
          type: string
          description: The ID of the association to be updated.
        roleArn:
          type: string
          description: The new IAM role to change in the association.
        clientRequestToken:
          type: string
          description: A unique, case-sensitive identifier that you provide to ensure the idempotency of the request.
        disableSessionTags:
          type: boolean
          description: Disable the automatic sessions tags that are appended by EKS Pod Identity. EKS Pod Identity adds a
            pre-defined set of session tags when it assumes the role. You can use these tags to author a single role that
            can work across resources by allowing access to Amazon Web Services resources based on matching tags. By default,
            EKS Pod Identity attaches six tags, including tags for cluster name, namespace, and service account name. For
            the list of tags added by EKS Pod Identity, see List of session tags added by EKS Pod Identity in the Amazon EKS
            User Guide. Amazon Web Services compresses inline sess
        targetRoleArn:
          type: string
          description: The Amazon Resource Name (ARN) of the target IAM role to associate with the service account. This role
            is assumed by using the EKS Pod Identity association role, then the credentials for this role are injected into
            the Pod. When you run applications on Amazon EKS, your application might need to access Amazon Web Services resources
            from a different role that exists in the same or different Amazon Web Services account. For example, your application
            running in “Account A” might need to access resources, such as buckets in “Account B” or within “Account A” itself.
            You can create a association to a
        policy:
          type: string
          description: 'An optional IAM policy in JSON format (as an escaped string) that applies additional restrictions
            to this pod identity association beyond the IAM policies attached to the IAM role. This policy is applied as the
            intersection of the role''s policies and this policy, allowing you to reduce the permissions that applications
            in the pods can use. Use this policy to enforce least privilege access while still leveraging a shared IAM role
            across multiple applications. Important considerations Session tags: When using this policy, disableSessionTags
            must be set to true. Target role permissions: If you sp'
      required:
      - clusterName
      - associationId
    UpdatePodIdentityAssociationResponse:
      type: object
      properties:
        association:
          $ref: '#/components/schemas/PodIdentityAssociation'
x-provenance:
  method: harvested
  publisher: Amazon Web Services
  source: https://raw.githubusercontent.com/aws/api-models-aws/582e55931c45b944739742a2c1620b6026dd2d13/models/eks/service/2017-11-01/eks-2017-11-01.json
  note: converted by smithy-to-openapi.py from AWS's Smithy model (roadmap#1001)