Skip to content

Commit 841db56

Browse files
committed
Resolve review of pr #1047
1 parent 7d907df commit 841db56

File tree

1 file changed

+2
-10
lines changed

1 file changed

+2
-10
lines changed

latest/ug/manage-access/aws-access/pod-id-role.adoc

Lines changed: 2 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -38,17 +38,9 @@ EKS Pod Identity uses `AssumeRole` to assume the IAM role before passing the tem
3838
EKS Pod Identity uses `TagSession` to include _session tags_ in the requests to {aws} STS.
3939

4040
*Setting Conditions*::
41-
You can use these tags in the _condition keys_ in the trust policy to restrict which service accounts, namespaces, and clusters can use this role. When the Pod Identity IAM Role is assumed, it sends the following Request Tags:
42-
43-
* `eks-cluster-arn`
44-
* `eks-cluster-name`
45-
* `kubernetes-namespace`
46-
* `kubernetes-service-account`
47-
* `kubernetes-pod-name`
48-
* `kubernetes-pod-uid`
49-
41+
You can use these tags in the _condition keys_ in the trust policy to restrict which service accounts, namespaces, and clusters can use this role. For the list of request tags that Pod Identity adds, see <<pod-id-abac-tags>>.
5042
+
51-
For example, to restrict a Pod Identity IAM Role to a specific `ServiceAccount` and `Namespace`, the following Trust Policy with the added `Condition` policies can further restrict what can assume the role:
43+
For example, you can restrict which pods can assume the role a Pod Identity IAM Role to a specific `ServiceAccount` and `Namespace` with the following Trust Policy with the added `Condition`:
5244
[source,json,subs="verbatim,attributes"]
5345
----
5446
{

0 commit comments

Comments
 (0)