java.lang.Object
- com.pulumi.resources.Resource
- - com.pulumi.resources.CustomResource
  - - com.pulumi.aws.eks.PodIdentityAssociation

public class PodIdentityAssociation
extends com.pulumi.resources.CustomResource

Resource for managing an AWS EKS (Elastic Kubernetes) Pod Identity Association. Creates an EKS Pod Identity association between a service account in an Amazon EKS cluster and an IAM role with EKS Pod Identity. Use EKS Pod Identity to give temporary IAM credentials to pods and the credentials are rotated automatically. Amazon EKS Pod Identity associations provide the ability to manage credentials for your applications, similar to the way that EC2 instance profiles provide credentials to Amazon EC2 instances. If a pod uses a service account that has an association, Amazon EKS sets environment variables in the containers of the pod. The environment variables configure the Amazon Web Services SDKs, including the Command Line Interface, to use the EKS Pod Identity credentials. Pod Identity is a simpler method than IAM roles for service accounts, as this method doesn’t use OIDC identity providers. Additionally, you can configure a role for Pod Identity once, and reuse it across clusters. ## Example Usage ### With Inline Session Policy

 
 package generated_program;
 
 import com.pulumi.Context;
 import com.pulumi.Pulumi;
 import com.pulumi.core.Output;
 import com.pulumi.aws.eks.PodIdentityAssociation;
 import com.pulumi.aws.eks.PodIdentityAssociationArgs;
 import static com.pulumi.codegen.internal.Serialization.*;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Map;
 import java.io.File;
 import java.nio.file.Files;
 import java.nio.file.Paths;
 
 public class App {
     public static void main(String[] args) {
         Pulumi.run(App::stack);
     }
 
     public static void stack(Context ctx) {
         var example = new PodIdentityAssociation("example", PodIdentityAssociationArgs.builder()
             .clusterName(exampleAwsEksCluster.name())
             .namespace("example")
             .serviceAccount("example-sa")
             .roleArn(exampleAwsIamRole.arn())
             .disableSessionTags(true)
             .policy(serializeJson(
                 jsonObject(
                     jsonProperty("Version", "2012-10-17"),
                     jsonProperty("Statement", jsonArray(jsonObject(
                         jsonProperty("Effect", "Allow"),
                         jsonProperty("Action", jsonArray("s3:GetObject")),
                         jsonProperty("Resource", "arn:aws:s3:::my-bucket/*")
                     )))
                 )))
             .build());
 
     }
 }

### Basic Usage

 
 package generated_program;
 
 import com.pulumi.Context;
 import com.pulumi.Pulumi;
 import com.pulumi.core.Output;
 import com.pulumi.aws.iam.IamFunctions;
 import com.pulumi.aws.iam.inputs.GetPolicyDocumentArgs;
 import com.pulumi.aws.iam.inputs.GetPolicyDocumentStatementArgs;
 import com.pulumi.aws.iam.inputs.GetPolicyDocumentStatementPrincipalArgs;
 import com.pulumi.aws.iam.Role;
 import com.pulumi.aws.iam.RoleArgs;
 import com.pulumi.aws.iam.RolePolicyAttachment;
 import com.pulumi.aws.iam.RolePolicyAttachmentArgs;
 import com.pulumi.aws.eks.PodIdentityAssociation;
 import com.pulumi.aws.eks.PodIdentityAssociationArgs;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Map;
 import java.io.File;
 import java.nio.file.Files;
 import java.nio.file.Paths;
 
 public class App {
     public static void main(String[] args) {
         Pulumi.run(App::stack);
     }
 
     public static void stack(Context ctx) {
         final var assumeRole = IamFunctions.getPolicyDocument(GetPolicyDocumentArgs.builder()
             .statements(GetPolicyDocumentStatementArgs.builder()
                 .principals(GetPolicyDocumentStatementPrincipalArgs.builder()
                     .type("Service")
                     .identifiers("pods.eks.amazonaws.com")
                     .build())
                 .effect("Allow")
                 .actions(                
                     "sts:AssumeRole",
                     "sts:TagSession")
                 .build())
             .build());
 
         var example = new Role("example", RoleArgs.builder()
             .name("eks-pod-identity-example")
             .assumeRolePolicy(assumeRole.json())
             .build());
 
         var exampleS3 = new RolePolicyAttachment("exampleS3", RolePolicyAttachmentArgs.builder()
             .policyArn("arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess")
             .role(example.name())
             .build());
 
         var examplePodIdentityAssociation = new PodIdentityAssociation("examplePodIdentityAssociation", PodIdentityAssociationArgs.builder()
             .clusterName(exampleAwsEksCluster.name())
             .namespace("example")
             .serviceAccount("example-sa")
             .roleArn(example.arn())
             .build());
 
     }
 }

## Import ### Identity Schema #### Required * `clusterName` (String) Name of the EKS Cluster. * `associationId` (String) ID of the association. #### Optional * `accountId` (String) AWS Account where this resource is managed. * `region` (String) Region where this resource is managed. Using `pulumi import`, import Pod Identity Associations using `clusterName` and `associationId` separated by a comma (`,`). For example: ```sh $ pulumi import aws:eks/podIdentityAssociation:PodIdentityAssociation example example-cluster,a-yrpsdroc4ei7k6xps ```

Nested Class Summary
- Nested classes/interfaces inherited from class com.pulumi.resources.CustomResource
  com.pulumi.resources.CustomResource.CustomResourceInternal
- Nested classes/interfaces inherited from class com.pulumi.resources.Resource
  com.pulumi.resources.Resource.LazyField<T extends java.lang.Object>, com.pulumi.resources.Resource.LazyFields, com.pulumi.resources.Resource.ResourceInternal

Field Summary
- Fields inherited from class com.pulumi.resources.Resource
  childResources, remote

Constructor Summary

Constructors
Constructor	Description
`PodIdentityAssociation(java.lang.String name)`
`PodIdentityAssociation(java.lang.String name, PodIdentityAssociationArgs args)`
`PodIdentityAssociation(java.lang.String name, PodIdentityAssociationArgs args, com.pulumi.resources.CustomResourceOptions options)`

Method Summary

All Methods Static Methods Instance Methods Concrete Methods
Modifier and Type	Method	Description
`com.pulumi.core.Output<java.lang.String>`	`associationArn()`
`com.pulumi.core.Output<java.lang.String>`	`associationId()`
`com.pulumi.core.Output<java.lang.String>`	`clusterName()`
`com.pulumi.core.Output<java.lang.Boolean>`	`disableSessionTags()`
`com.pulumi.core.Output<java.lang.String>`	`externalId()`
`static PodIdentityAssociation`	`get(java.lang.String name, com.pulumi.core.Output<java.lang.String> id, PodIdentityAssociationState state, com.pulumi.resources.CustomResourceOptions options)`	Get an existing Host resource's state with the given name, ID, and optional extra properties used to qualify the lookup.
`com.pulumi.core.Output<java.lang.String>`	`namespace()`
`com.pulumi.core.Output<java.util.Optional<java.lang.String>>`	`policy()`
`com.pulumi.core.Output<java.lang.String>`	`region()`
`com.pulumi.core.Output<java.lang.String>`	`roleArn()`
`com.pulumi.core.Output<java.lang.String>`	`serviceAccount()`
`com.pulumi.core.Output<java.util.Optional<java.util.Map<java.lang.String,java.lang.String>>>`	`tags()`
`com.pulumi.core.Output<java.util.Map<java.lang.String,java.lang.String>>`	`tagsAll()`
`com.pulumi.core.Output<java.util.Optional<java.lang.String>>`	`targetRoleArn()`

Methods inherited from class com.pulumi.resources.CustomResource
getId, id, idFuture

Methods inherited from class com.pulumi.resources.Resource
getChildResources, getResourceName, getResourceType, getUrn, pulumiChildResources, pulumiResourceName, pulumiResourceType, urn

Methods inherited from class java.lang.Object
clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

- Constructor Detail
  - PodIdentityAssociation
```
public PodIdentityAssociation(java.lang.String name)
```
    Parameters:
    
    name - The _unique_ name of the resulting resource.
  - PodIdentityAssociation
```
public PodIdentityAssociation(java.lang.String name,
                              PodIdentityAssociationArgs args)
```
    Parameters:
    
    name - The _unique_ name of the resulting resource.
    
    args - The arguments to use to populate this resource's properties.
  - PodIdentityAssociation
```
public PodIdentityAssociation(java.lang.String name,
                              PodIdentityAssociationArgs args,
                              @Nullable
                              com.pulumi.resources.CustomResourceOptions options)
```
    Parameters:
    
    name - The _unique_ name of the resulting resource.
    
    args - The arguments to use to populate this resource's properties.
    
    options - A bag of options that control this resource's behavior.
- Method Detail
  - associationArn
```
public com.pulumi.core.Output<java.lang.String> associationArn()
```
    Returns:
    
    ARN of the association.
  - associationId
```
public com.pulumi.core.Output<java.lang.String> associationId()
```
    Returns:
    
    The ID of the association.
  - clusterName
```
public com.pulumi.core.Output<java.lang.String> clusterName()
```
    Returns:
    
    The name of the cluster to create the association in.
  - disableSessionTags
```
public com.pulumi.core.Output<java.lang.Boolean> disableSessionTags()
```
    Returns:
    
    Disable the tags that are automatically added to role session by Amazon EKS. Must be set to `true` when `policy` is specified.
  - externalId
```
public com.pulumi.core.Output<java.lang.String> externalId()
```
    Returns:
    
    The unique identifier for this association for a target IAM role. You put this value in the trust policy of the target role, in a Condition to match the sts.ExternalId.
  - namespace
```
public com.pulumi.core.Output<java.lang.String> namespace()
```
    Returns:
    
    The name of the Kubernetes namespace inside the cluster to create the association in. The service account and the pods that use the service account must be in this namespace.
  - policy
```
public com.pulumi.core.Output<java.util.Optional<java.lang.String>> policy()
```
    Returns:
    
    An IAM policy in JSON format (as an escaped string) that applies additional restrictions to this Pod Identity association beyond the IAM policies attached to the IAM role. The effective permissions are the intersection of the role's policies and this policy, allowing you to enforce least privilege across multiple associations that share the same role. Requires `disableSessionTags = true`.
  - region
```
public com.pulumi.core.Output<java.lang.String> region()
```
    Returns:
    
    Region where this resource will be [managed](https://docs.aws.amazon.com/general/latest/gr/rande.html#regional-endpoints). Defaults to the Region set in the provider configuration.
  - roleArn
```
public com.pulumi.core.Output<java.lang.String> roleArn()
```
    Returns:
    
    ARN of the IAM role to associate with the service account. The EKS Pod Identity agent manages credentials to assume this role for applications in the containers in the pods that use this service account.
  - serviceAccount
```
public com.pulumi.core.Output<java.lang.String> serviceAccount()
```
    Returns:
    
    The name of the Kubernetes service account inside the cluster to associate the IAM credentials with. The following arguments are optional:
  - tags
```
public com.pulumi.core.Output<java.util.Optional<java.util.Map<java.lang.String,java.lang.String>>> tags()
```
    Returns:
    
    Key-value map of resource tags. If configured with a provider `defaultTags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
  - tagsAll
```
public com.pulumi.core.Output<java.util.Map<java.lang.String,java.lang.String>> tagsAll()
```
    Returns:
    
    A map of tags assigned to the resource, including those inherited from the provider `defaultTags` configuration block.
  - targetRoleArn
```
public com.pulumi.core.Output<java.util.Optional<java.lang.String>> targetRoleArn()
```
    Returns:
    
    ARN of the IAM role to be chained to the the IAM role specified as `roleArn`.
  - get
```
public static PodIdentityAssociation get(java.lang.String name,
                                         com.pulumi.core.Output<java.lang.String> id,
                                         @Nullable
                                         PodIdentityAssociationState state,
                                         @Nullable
                                         com.pulumi.resources.CustomResourceOptions options)
```
    Get an existing Host resource's state with the given name, ID, and optional extra properties used to qualify the lookup.
    
    Parameters:
    
    name - The _unique_ name of the resulting resource.
    
    id - The _unique_ provider ID of the resource to lookup.
    
    state -
    
    options - Optional settings to control the behavior of the CustomResource.

Class PodIdentityAssociation

Nested Class Summary

Nested classes/interfaces inherited from class com.pulumi.resources.CustomResource

Nested classes/interfaces inherited from class com.pulumi.resources.Resource

Field Summary

Fields inherited from class com.pulumi.resources.Resource

Constructor Summary

Method Summary

Methods inherited from class com.pulumi.resources.CustomResource

Methods inherited from class com.pulumi.resources.Resource

Methods inherited from class java.lang.Object

Constructor Detail

PodIdentityAssociation

PodIdentityAssociation

PodIdentityAssociation

Method Detail

associationArn

associationId

clusterName

disableSessionTags

externalId

namespace

policy

region

roleArn

serviceAccount

tags

tagsAll

targetRoleArn

get