Use Mountpoint for Amazon S3 storage

Open the IAM console at https://console.aws.amazon.com/iam/.

In the left navigation pane, choose Roles.

On the Roles page, choose Create role.

On the Select trusted entity page, do the following:

1. In the Trusted entity type section, choose Web identity.

2. For Identity provider, choose the OpenID Connect provider URL for your cluster (as shown under Overview in Amazon EKS).

   If no URLs are shown, review the Prerequisites section.

3. For Audience, choose sts.amazonaws.com.

4. Choose Next.

On the Add permissions page, do the following:

1. In the Filter policies box, enter AmazonS3CSIDriverPolicy.

   Note

   This policy was created in the previous section.

2. Select the check box to the left of the AmazonS3CSIDriverPolicy result that was returned in the search.

3. Choose Next.

On the Name, review, and create page, do the following:

1. For Role name, enter a unique name for your role, such as AmazonEKS_S3_CSI_DriverRole.

2. Under Add tags (Optional), add metadata to the role by attaching tags as key-value pairs. For more information about using tags in IAM, see Tagging IAM resources in the IAM User Guide.

3. Choose Create role.

After the role is created, choose the role in the console to open it for editing.

Choose the Trust relationships tab, and then choose Edit trust policy.

Find the line that looks similar to the following:

"oidc.eks.region-code.amazonaws.com/id/EXAMPLED539D4633E53DE1B71EXAMPLE:aud": "sts.amazonaws.com"

Add a comma to the end of the previous line, and then add the following line after it. Replace region-code with the AWS Region that your cluster is in. Replace EXAMPLED539D4633E53DE1B71EXAMPLE with your cluster's OIDC provider ID.

"oidc.eks.region-code.amazonaws.com/id/EXAMPLED539D4633E53DE1B71EXAMPLE:sub": "system:serviceaccount:kube-system:s3-csi-*"

Change the Condition operator from "StringEquals" to "StringLike".

Choose Update policy to finish.

View the OIDC provider URL for your cluster. Replace my-cluster with the name of your cluster. If the output from the command is None, review the Prerequisites.

aws eks describe-cluster --name my-cluster --query "cluster.identity.oidc.issuer" --output text

An example output is as follows.

https://oidc.eks.region-code.amazonaws.com/id/EXAMPLED539D4633E53DE1B71EXAMPLE

Create the IAM role, granting the Kubernetes service account the AssumeRoleWithWebIdentity action.

1. Copy the following contents to a file named aws-s3-csi-driver-trust-policy.json. Replace 111122223333 with your account ID. Replace EXAMPLED539D4633E53DE1B71EXAMPLE and region-code with the values returned in the previous step.

   {
     "Version": "2012-10-17",
     "Statement": [
       {
         "Effect": "Allow",
         "Principal": {
           "Federated": "arn:aws:iam::111122223333:oidc-provider/oidc.eks.region-code.amazonaws.com/id/EXAMPLED539D4633E53DE1B71EXAMPLE"
         },
         "Action": "sts:AssumeRoleWithWebIdentity",
         "Condition": {
           "StringLike": {
             "oidc.eks.region-code.amazonaws.com/id/EXAMPLED539D4633E53DE1B71EXAMPLE:sub": "system:serviceaccount:kube-system:s3-csi-*",
             "oidc.eks.region-code.amazonaws.com/id/EXAMPLED539D4633E53DE1B71EXAMPLE:aud": "sts.amazonaws.com"
           }
         }
       }
     ]
   }

2. Create the role. You can change AmazonEKS_S3_CSI_DriverRole to a different name, but if you do, make sure to change it in later steps too.

   aws iam create-role \
     --role-name AmazonEKS_S3_CSI_DriverRole \
     --assume-role-policy-document file://"aws-s3-csi-driver-trust-policy.json"
   

Attach the previously created IAM policy to the role with the following command.

aws iam attach-role-policy \
  --policy-arn arn:aws:iam::aws:policy/AmazonS3CSIDriverPolicy \
  --role-name AmazonEKS_S3_CSI_DriverRole

Skip this step if you're installing the driver as an Amazon EKS add-on. For self-managed installations of the driver, create Kubernetes service accounts that are annotated with the ARN of the IAM role that you created.

1. Save the following contents to a file named mountpoint-s3-service-account.yaml. Replace 111122223333 with your account ID.

   ---
   apiVersion: v1
   kind: ServiceAccount
   metadata:
     labels:
       app.kubernetes.io/name: aws-mountpoint-s3-csi-driver
     name: mountpoint-s3-csi-controller-sa
     namespace: kube-system
     annotations:
       eks.amazonaws.com/role-arn: arn:aws:iam::111122223333:role/AmazonEKS_S3_CSI_DriverRole
   
       

2. Create the Kubernetes service account on your cluster. The Kubernetes service account (mountpoint-s3-csi-controller-sa) is annotated with the IAM role that you created named AmazonEKS_S3_CSI_DriverRole.

   kubectl apply -f mountpoint-s3-service-account.yaml
   

   Note

   When you deploy the plugin in this procedure, it creates and is configured to use a service account named s3-csi-driver-sa.

Open the Amazon EKS console at https://console.aws.amazon.com/eks/home#/clusters.

In the left navigation pane, choose Clusters.

Choose the name of the cluster that you want to configure the Mountpoint for Amazon S3 CSI add-on for.

Choose the Add-ons tab.

Choose Get more add-ons.

On the Select add-ons page, do the following:

1. In the Amazon EKS-addons section, select the Mountpoint for Amazon S3 CSI Driver check box.

2. Choose Next.

On the Configure selected add-ons settings page, do the following:

1. Select the Version you'd like to use.

2. For Select IAM role, select the name of an IAM role that you attached the Mountpoint for Amazon S3 CSI driver IAM policy to.

3. (Optional) You can expand the Optional configuration settings. If you select Override for the Conflict resolution method, one or more of the settings for the existing add-on can be overwritten with the Amazon EKS add-on settings. If you don't enable this option and there's a conflict with your existing settings, the operation fails. You can use the resulting error message to troubleshoot the conflict. Before selecting this option, make sure that the Amazon EKS add-on doesn't manage settings that you need to self-manage.

4. Choose Next.

On the Review and add page, choose Create. After the add-on installation is complete, you see your installed add-on.

Open the Amazon EKS console at https://console.aws.amazon.com/eks/home#/clusters.

In the left navigation pane, choose Clusters.

Choose the name of the cluster that you want to remove the Amazon EBS CSI add-on for.

Choose the Add-ons tab.

Choose Mountpoint for Amazon S3 CSI Driver.

Choose Remove.

In the Remove: aws-mountpoint-s3-csi-driver confirmation dialog box, do the following:

1. If you want Amazon EKS to stop managing settings for the add-on, select Preserve on cluster. Do this if you want to retain the add-on software on your cluster. This is so that you can manage all of the settings of the add-on on your own.

2. Enter aws-mountpoint-s3-csi-driver.

3. Select Remove.